bug#47474: fossil: hash mismatch

[Jack Hill]

On Mon, 8 Nov 2021, zimoun wrote:

> Indeed, when looking forward. :-)
>
> However, in the context of Disarchive and long-term, it is seems
> relevant to keep it still open; as example to test “guix time-machine”
> and various fallbacks, IMHO.

I'm also curious to know to fill in the archive for old versions. I guess 
the first step would be to preserve the tarballs with the original hashes. 
Does anyone have them? I notice that this happened again with 2.17:

downloading from 
https://www.fossil-scm.org/home/tarball/f48180f2ff3169651a725396d4f7d667c99a92873b9c3df7eee2f144be7a0721/fossil-src-2.17.tar.gz
 ...
 fossil-src-2.17.tar.gz  6.0MiB                                                 
          4.0MiB/s 00:02 [##################] 100.0%
sha256 hash mismatch for 
/gnu/store/i695w5hp8vkgvkx40rs8p647mas0ldah-fossil-src-2.17.tar.gz:
  expected hash: 1gvx6xzrw1a8snlq9qmr6099r44ifghg0h0fw4jazqmmyxriqzsw
  actual hash:   18q5rc1d9d2zvrvsas5h419dv525ig9lyqswrx7bcl38zbjxics4

Looking forward:

I have asked upstream how we might avoid this problem: 
https://fossil-scm.org/forum/forumpost/4903c3fcc1

We'll see what they say.

Some other ideas in the meantime:

1) Develop a fossil-fetch that can be used like git-fetch to download from 
the source code repository directly.

2) Use git-fetch with the git-mirror. This would allow us to make use of 
our current git integration with Software Heritage.

Best,
Jack