Re: [cross-project-issues-dev] MD5 hash not as expect for org.eclipse.je

[Ondrej Dockal <odockal@xxxxxxxxxx>]

Thanks folks for clarification.

For p2 I am using https://download.eclipse.org/releases/2023-09/. Tycho is 2.7.5.

I am not directly using jetty, it is a transitive dependency so I do not control from where it is being downloaded from.

I will try to update tycho to see if that fixes the problem.

On Mon, Aug 28, 2023 at 1:30 PM Ed Merks via cross-project-issues-dev <cross-project-issues-dev@xxxxxxxxxxx> wrote:

Using the simrel.aggran, I can track the source of the artifact to here:

https://download.eclipse.org/webtools/jetty/10.0.15/repository/

It's like this in https://www.eclipse.org/downloads/download.php?file=/webtools/jetty/10.0.15/repository/artifacts.jar

    <artifact classifier='osgi.bundle' id='org.eclipse.jetty.jndi' version='10.0.15'>
      <properties size='7'>
        <property name='artifact.size' value='57741'/>
        <property name='download.size' value='57741'/>
        <property name='download.md5' value='785f479c6433717bee8e9bb94df56c11'/>
        <property name='download.checksum.md5' value='785f479c6433717bee8e9bb94df56c11'/>
        <property name='download.checksum.sha-256' value='623f2009671f0138495fd659622fd78e3153671a50a1c280aeb2410e9365b455'/>
        <property name='download.checksum.sha-512' value='7bddbd236d0d238b5852d2f774793e84d18148a16fc76819fbf87926e53ad0bc5e2ef6c95a3619887b98f5bb8a625ac289bf68f3b4009af72fcdb2d95a604dca'/>
        <property name='download.checksum.sha-1' value='488a1601bae6f4d0357e6a4b4174e1dcfca068af'/>
      </properties>
    </artifact>

That md5 does appear to be wrong when I compute it on the command line:

$md5sum org.eclipse.jetty.jndi_10.0.15.jar
8f2d6b1e2acef3285e3a12f62042890c *org.eclipse.jetty.jndi_10.0.15.jar

It's like that in the https://download.eclipse.org/oomph/jetty/release/10.0.15  repo as well:

    <artifact classifier='osgi.bundle' id='org.eclipse.jetty.jndi' version='10.0.15'>
      <properties size='12'>
        <property name='artifact.size' value='48018'/>
        <property name='download.size' value='48018'/>
        <property name='download.md5' value='785f479c6433717bee8e9bb94df56c11'/>
        <property name='download.checksum.sha-512' value='21a969e35a344dd2992f1401f03d8ed995c320c69c0949aea222a68176badfa7c5bda0d0c080a513a58694d160744b66e52feecd00392b097d1cd8282eca2d27'/>
        <property name='download.checksum.md5' value='785f479c6433717bee8e9bb94df56c11'/>
        <property name='download.checksum.sha-256' value='c01a1d2ea0ebac1565f4c8e92d1b5151daf14ac09502efd52f5536a59245cb16'/>
        <property name='maven.artifactId' value='jetty-jndi'/>
        <property name='maven.extension' value='jar'/>
        <property name='maven.version' value='10.0.15'/>
        <property name='maven.groupId' value='org.eclipse.jetty'/>

But for that repo it's correct:

$md5sum org.eclipse.jetty.jndi_10.0.15\(2\).jar
785f479c6433717bee8e9bb94df56c11 *org.eclipse.jetty.jndi_10.0.15(2).jar

How can that be?

In https://download.eclipse.org/webtools/jetty/10.0.15/repository it is jar-signed (which should not be done)and it did not recompute all the checksums:

The one with the correct md5 in https://download.eclipse.org/oomph/jetty/release/10.0.15  is not signed signed:

My theory is that because p2 no longer produces nor consumes md5, it will fail recompute these sums if they are already present and it will  fail to notice they are wrong if they are present.

Maybe you are using quite an old version of Tycho with quite an older version of p2?

I'll investigate completely removing these unused properties during aggregation; the aggregator already computes stronger checksums if they are missing.

I changed WTP's contribution to use Oomph's jetty repo and have rebuilt staging.  I see this in the log:

13:20:27  Mirroring artifacts from https://download.eclipse.org/oomph/jetty/release/10.0.15
13:20:28  - mirroring artifact osgi.bundle,org.eclipse.jetty.jndi,10.0.15
13:20:28  - mirrored artifact osgi.bundle,org.eclipse.jetty.jndi,10.0.15

I checked that the staging version of the artifact is not a signed version, so I think this is fixed.

Regards,
Ed

On 28.08.2023 12:11, Ondrej Dockal via cross-project-issues-dev wrote:

Hey folks,

in RedDeer build [1] we are facing an issue when running the tests with a checksum for org.eclipse.jetty.jndi.

Error message:

12:05:07 [INFO] Fetching org.eclipse.jetty.util_10.0.15.jar from https://download.eclipse.org/staging/2023-09/plugins/ (557.33kB)
12:05:07 [INFO] Fetching org.eclipse.jetty.jndi_10.0.15.jar from https://download.eclipse.org/staging/2023-09/plugins/ (56.39kB)
12:05:07 [ERROR] An error occurred while transferring artifact canonical: osgi.bundle,org.eclipse.jetty.jndi,10.0.15 from repository https://download.eclipse.org/staging/2023-09:
12:05:07 [ERROR]    Problems downloading artifact: osgi.bundle,org.eclipse.jetty.jndi,10.0.15.:
12:05:07 [ERROR]       MD5 hash is not as expected. Expected: 785f479c6433717bee8e9bb94df56c11 and found 8f2d6b1e2acef3285e3a12f62042890c.

Any hints?

Regards,

Ondrej

[1]: https://ci.eclipse.org/reddeer/job/reddeer.verification.parametrized/136/console
--

Ondrej Dockal

Senior Software Quality Engineer, Developer QE

Red Hat Czech, s.r.o.

Purkyňova 111

Brno 612 00, Czech Republic

odockal@xxxxxxxxxx

_______________________________________________
cross-project-issues-dev mailing list
cross-project-issues-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/cross-project-issues-dev

_______________________________________________
cross-project-issues-dev mailing list
cross-project-issues-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/cross-project-issues-dev