On Fri, May 29, 2020 at 03:35:10PM -0700, Tianon Gravi wrote: > Hi friends! <3 >
Hello! > It appears that "haproxy-1.8.25.tar.gz" was republished (sometime in > the last ~24 hours), and I can't find any information about why (or > what changed) -- does anyone have some insight? > > Old SHA256: 62c0b77de2275a54a443a869947ddcca2bad7bdc1cafd804732a0e0d59b1708b > New SHA256: da0d75df38683fac724f515e45d6b81be52f00ac9fb6387281b6caaff419bf7d > > More specifically, this appears to have changed sometime today (Fri 29 > May 2020) between 11:13 AM (UTC) and 05:13 PM (UTC). > Indeed the tarball was regenerated by accident. As lots of build system out there checks the previous checksum I'm going to reupload the previous one. > I've got a copy of built artifacts from the previous published > artifact, but unfortunately not the old tarball itself, so I can't use > something like diffoscope to compare the published bits directly. /o\ > > The way I'm building also isn't explicitly reproducible, so the > diffoscope on the built artifacts doesn't seem all that useful either > since there's a lot of false positives in it that likely boil down to > newer dependencies, timestamps, etc (since my older build is from 2 > weeks ago). > > (I'm not subscribed, so please keep me on CC for replies!) > The content of the tarball didn't changed, only the metadata. I'm reuploading the old one as well as the .md5 and .sha256. Thanks for the report and sorry for the trouble! -- William Lallemand
