Discussion:
[vbox-dev] hash sum mismatch
Stéphane Charette
2014-03-25 19:02:02 UTC
Permalink
Does the VirtualBox team silently replace the linux download package
without changing the version number?

We're trying to figure out why our deployed devices every once in a while
encounter problems when running "apt-get update". This error causes
apt-get to exit with return code 100, and the rest of the update scripts
cannot continue to apply updates. Here is what we're seeing:

sudo apt-get update
...
W: Failed to fetch
bzip2:/var/lib/apt/lists/partial/download.virtualbox.org_virtualbox_debian_dists_saucy_contrib_binary-amd64_Packages
Hash Sum mismatch
W: Failed to fetch
copy:/var/lib/apt/lists/partial/download.virtualbox.org_virtualbox_debian_dists_saucy_contrib_binary-i386_Packages
Hash Sum mismatch

Every time it happens, it is always with VirtualBox, no other PPA or
package seems to ever causes this problem.

St?phane
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140325/2f823558/attachment.html
Frank Mehnert
2014-03-25 19:10:45 UTC
Permalink
Post by Stéphane Charette
Does the VirtualBox team silently replace the linux download package
without changing the version number?
No, the team does not.
Post by Stéphane Charette
We're trying to figure out why our deployed devices every once in a while
encounter problems when running "apt-get update". This error causes
apt-get to exit with return code 100, and the rest of the update scripts
sudo apt-get update
...
W: Failed to fetch
bzip2:/var/lib/apt/lists/partial/download.virtualbox.org_virtualbox_debian_d
ists_saucy_contrib_binary-amd64_Packages Hash Sum mismatch
W: Failed to fetch
copy:/var/lib/apt/lists/partial/download.virtualbox.org_virtualbox_debian_di
sts_saucy_contrib_binary-i386_Packages Hash Sum mismatch
Every time it happens, it is always with VirtualBox, no other PPA or
package seems to ever causes this problem.
Sorry, I have no idea.

Frank
--
Dr.-Ing. Frank Mehnert | Software Development Director, VirtualBox
ORACLE Deutschland B.V. & Co. KG | Werkstr. 24 | 71384 Weinstadt, Germany

Hauptverwaltung: Riesstr. 25, D-80992 M?nchen
Registergericht: Amtsgericht M?nchen, HRA 95603
Gesch?ftsf?hrer: J?rgen Kunz

Komplement?rin: ORACLE Deutschland Verwaltung B.V.
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697
Gesch?ftsf?hrer: Alexander van der Ven, Astrid Kepper, Val Maher
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140325/328c73ef/attachment.bin
Stéphane Charette
2014-03-26 21:37:58 UTC
Permalink
Post by Frank Mehnert
Post by Stéphane Charette
Does the VirtualBox team silently replace the linux download package
without changing the version number?
No, the team does not.
Frank, are you absolutely sure? Didn't this just happen again with a
re-release of 4.3.10?

St?phane
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140326/c6b108a4/attachment.html
Frank Mehnert
2014-03-26 21:46:08 UTC
Permalink
St?phane,
On Tue, Mar 25, 2014 at 12:10 PM, Frank Mehnert
Post by Frank Mehnert
Post by Stéphane Charette
Does the VirtualBox team silently replace the linux download package
without changing the version number?
No, the team does not.
Frank, are you absolutely sure? Didn't this just happen again with a
re-release of 4.3.10?
yes, I am sure. I'm just replacing the 4.3.10 packages but the package
names change (different revision). Currently the Debian repository is
not sane as the package references point to packages which are not there
but this will be repaired in ~1 hour. And this is not the cause of the
problem you saw yesterday.

Kind regards,

Frank
--
Dr.-Ing. Frank Mehnert | Software Development Director, VirtualBox
ORACLE Deutschland B.V. & Co. KG | Werkstr. 24 | 71384 Weinstadt, Germany

Hauptverwaltung: Riesstr. 25, D-80992 M?nchen
Registergericht: Amtsgericht M?nchen, HRA 95603
Gesch?ftsf?hrer: J?rgen Kunz

Komplement?rin: ORACLE Deutschland Verwaltung B.V.
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697
Gesch?ftsf?hrer: Alexander van der Ven, Astrid Kepper, Val Maher
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140326/7b03a45f/attachment.bin
Martin Simmons
2014-03-27 13:53:34 UTC
Permalink
Post by Stéphane Charette
Post by Frank Mehnert
Post by Stéphane Charette
Does the VirtualBox team silently replace the linux download package
without changing the version number?
No, the team does not.
Frank, are you absolutely sure? Didn't this just happen again with a
re-release of 4.3.10?
Maybe you are being hit by one of the problems in the bug report below?

https://bugs.launchpad.net/ubuntu/+source/apt/+bug/972077

__Martin
thoms
2014-03-27 15:17:33 UTC
Permalink
The current 'SHA256SUM' file identifies these file hashes as:

0796a0043cb8a965695df75f0a245ff7645596c22c5832e06daa5cd1ba538461
*UserManual.pdf
247e15e9a205dcd4761f6cb547ceca2a61e8d6905c1930870939fd323f4cd1ae
*VBoxGuestAdditions_4.3.10.iso
739835aee3274a663b23eeb748bd0430e8a5d8ba2f4d0eae5dc47ff2c485e23b
*VirtualBox-4.3.10.tar.bz2


Running 'sha256sum' against these files reports:

e702b56a728f01b408857ab5d4bebfcb960c68d282c34872e1a44cc7e71a5c41
*UserManual.pdf
2b31a2b5327ed6babd510ff7edf7deb86c4286e6720357185049bbd1625ca934
*VBoxGuestAdditions_4.3.10.iso
b8555c254a9fc79833d17d5ad9e22a6aa8190d5202eb65d9ba004d1ce9535357
*VirtualBox-4.3.10.tar.bz2


Running 'md5sum' also reports these three files as 'FAILED'.

Note that I did not download packages for mdv, openSuSE, sles, OSX,
Debian or Ubuntu, and therefore did not evaluate their hashes.

-Thom
Post by Martin Simmons
Post by Stéphane Charette
Post by Frank Mehnert
Post by Stéphane Charette
Does the VirtualBox team silently replace the linux download package
without changing the version number?
No, the team does not.
Frank, are you absolutely sure? Didn't this just happen again with a
re-release of 4.3.10?
Maybe you are being hit by one of the problems in the bug report below?
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/972077
__Martin
_______________________________________________
vbox-dev mailing list
vbox-dev at virtualbox.org
https://www.virtualbox.org/mailman/listinfo/vbox-dev
Frank Mehnert
2014-03-27 15:34:45 UTC
Permalink
Again,

could you PLEASE use the hashes from the Download page? As I said
several times, the hashes on download.virtualbox.org/virtualbox
are not up-to-date. The server needs some time (1 day?) to deliver
the correct content.

Thank you!

Frank
Post by thoms
0796a0043cb8a965695df75f0a245ff7645596c22c5832e06daa5cd1ba538461
*UserManual.pdf
247e15e9a205dcd4761f6cb547ceca2a61e8d6905c1930870939fd323f4cd1ae
*VBoxGuestAdditions_4.3.10.iso
739835aee3274a663b23eeb748bd0430e8a5d8ba2f4d0eae5dc47ff2c485e23b
*VirtualBox-4.3.10.tar.bz2
e702b56a728f01b408857ab5d4bebfcb960c68d282c34872e1a44cc7e71a5c41
*UserManual.pdf
2b31a2b5327ed6babd510ff7edf7deb86c4286e6720357185049bbd1625ca934
*VBoxGuestAdditions_4.3.10.iso
b8555c254a9fc79833d17d5ad9e22a6aa8190d5202eb65d9ba004d1ce9535357
*VirtualBox-4.3.10.tar.bz2
Running 'md5sum' also reports these three files as 'FAILED'.
Note that I did not download packages for mdv, openSuSE, sles, OSX,
Debian or Ubuntu, and therefore did not evaluate their hashes.
-Thom
Post by Martin Simmons
On Tue, Mar 25, 2014 at 12:10 PM, Frank Mehnert
Post by Frank Mehnert
Post by Stéphane Charette
Does the VirtualBox team silently replace the linux download package
without changing the version number?
No, the team does not.
Frank, are you absolutely sure? Didn't this just happen again with a
re-release of 4.3.10?
Maybe you are being hit by one of the problems in the bug report below?
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/972077
__Martin
_______________________________________________
vbox-dev mailing list
vbox-dev at virtualbox.org
https://www.virtualbox.org/mailman/listinfo/vbox-dev
_______________________________________________
vbox-dev mailing list
vbox-dev at virtualbox.org
https://www.virtualbox.org/mailman/listinfo/vbox-dev
--
Dr.-Ing. Frank Mehnert | Software Development Director, VirtualBox
ORACLE Deutschland B.V. & Co. KG | Werkstr. 24 | 71384 Weinstadt, Germany

Hauptverwaltung: Riesstr. 25, D-80992 M?nchen
Registergericht: Amtsgericht M?nchen, HRA 95603
Gesch?ftsf?hrer: J?rgen Kunz

Komplement?rin: ORACLE Deutschland Verwaltung B.V.
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697
Gesch?ftsf?hrer: Alexander van der Ven, Astrid Kepper, Val Maher
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140327/ee235925/attachment.bin
Frank Mehnert
2014-03-27 15:44:46 UTC
Permalink
Hi,
Post by Frank Mehnert
could you PLEASE use the hashes from the Download page? As I said
several times, the hashes on download.virtualbox.org/virtualbox
are not up-to-date. The server needs some time (1 day?) to deliver
the correct content.
sorry if I to unspecific:

https://www.virtualbox.org/download/hashes/4.3.10/SHA256SUMS
https://www.virtualbox.org/download/hashes/4.3.10/MD5SUMS


Thanks,

Frank
--
Dr.-Ing. Frank Mehnert | Software Development Director, VirtualBox
ORACLE Deutschland B.V. & Co. KG | Werkstr. 24 | 71384 Weinstadt, Germany

Hauptverwaltung: Riesstr. 25, D-80992 M?nchen
Registergericht: Amtsgericht M?nchen, HRA 95603
Gesch?ftsf?hrer: J?rgen Kunz

Komplement?rin: ORACLE Deutschland Verwaltung B.V.
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697
Gesch?ftsf?hrer: Alexander van der Ven, Astrid Kepper, Val Maher
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140327/80fd4420/attachment.bin
Frank Mehnert
2014-03-28 09:28:38 UTC
Permalink
Hi,
Post by Frank Mehnert
Post by Frank Mehnert
could you PLEASE use the hashes from the Download page? As I said
several times, the hashes on download.virtualbox.org/virtualbox
are not up-to-date. The server needs some time (1 day?) to deliver
the correct content.
https://www.virtualbox.org/download/hashes/4.3.10/SHA256SUMS
https://www.virtualbox.org/download/hashes/4.3.10/MD5SUMS
just checked: In the mean time all hashes are consistent again. So it
doesn't matter if you get your hashes from https://www.virtualbox.org
or from http://download.virtualbox.org/virtualbox

Thanks,

Frank
--
Dr.-Ing. Frank Mehnert | Software Development Director, VirtualBox
ORACLE Deutschland B.V. & Co. KG | Werkstr. 24 | 71384 Weinstadt, Germany

Hauptverwaltung: Riesstr. 25, D-80992 M?nchen
Registergericht: Amtsgericht M?nchen, HRA 95603
Gesch?ftsf?hrer: J?rgen Kunz

Komplement?rin: ORACLE Deutschland Verwaltung B.V.
Hertogswetering 163/167, 3543 AS Utrecht, Niederlande
Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697
Gesch?ftsf?hrer: Alexander van der Ven, Astrid Kepper, Val Maher
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
Url : http://www.virtualbox.org/pipermail/vbox-dev/attachments/20140328/2bb6971b/attachment.bin
Loading...