Unable to download sources from dereferenced.org
jcar87 opened this issue · comments
It looks like the server the webserver that serves the source distributions for pkgconf is no longer working, e.g. https://distfiles.dereferenced.org/pkgconf/pkgconf-1.9.3.tar.xz is simply timing out.
This causes problems for package repositories where the canonical sources are expected in this location. Sources from GitHub could be an alternative, however I imagine autoreconf needs to be invoked ahead of calling the configure script, so the contents are not exactly the same. Additionally, there's been issues in the past with GitHub archives not being SHA-stable (even if the contents are), which is a requirement for package repositories.
Any updates on this would be appreciated - or if the original files for the source distributions (with the original contents) could be uploaded as GitHub release artifacts (I believe those are guaranteed to be immutable in terms of hash).
Could we either use GitHub Releases to post official releases, or is distfiles.dereferenced.org mirrored somewhere? All build systems that depend on downloading pkgconf are down right now.
Google searched out only 2 irrelevant results about distfiles.dereferenced.org in the last 7days. It is amazing that few people find it disappeared, like it never exists.
Any updates? Buildroot does not work because the mirror is down.
I don't know if the mirror is coming back..
I've found a solution: archive.org
The latest pkgconf backup is 1.7.4
I have mirrored the latest release here: https://github.com/wingtk/gvsbuild/releases/download/pkgconf-1.9.5/pkgconf-1.9.5.tar.gz. I think you could also use a gentoo mirror as well: https://gentoo.osuosl.org/distfiles/pkgconf-1.9.5.tar.xz
All the archives are listed here
Manual Link:
https://web.archive.org/web/*/https://distfiles.dereferenced.org/pkgconf* (Edit: Including the * at the end)
I have mirrored the latest release here: https://github.com/wingtk/gvsbuild/releases/download/pkgconf-1.9.5/pkgconf-1.9.5.tar.gz. I think you could also use a gentoo mirror as well: https://gentoo.osuosl.org/distfiles/pkgconf-1.9.5.tar.xz
Do you have access to 1.6.5, I need pkgconf 1.6.5 to run buildroot.
Is there any way to generate the archives, the same one as in the mirror?
Since I got here because gvsbuild build gtk4 breaks because of this, I just have to ask, why does the script fail to verify checksum?
https://github.com/pkgconf/pkgconf/archive/refs/tags/pkgconf-1.9.5.tar.gz
3fd0ace7d4398d75f0c566759f9beb4f8b3984fee7ed9804d41c52b193d9745a
https://distfiles.dereferenced.org/pkgconf/pkgconf-1.9.5.tar.gz
6466efd2e38c4c0ac5de4e345f0dc6dad57e689efb08c31f2a71547683d20dc7
should we just assume foul play here? :p
@kumorig This blog post explains the issue: https://github.blog/2023-02-21-update-on-the-future-stability-of-source-code-archives-and-hashes/
@kumorig - there's also a chance that the tar.gz have different contents - the ones that are a git snapshot may not contain the ./configure script and you need to call autoreconf to generate it, whereas the "source distribution" files hosted on the website do. This is a very typical scenario
It sounds like @kaniini lost access to the domain, so we'll all need to be patient while they resolve it:
https://social.treehouse.systems/@ariadne/110643909699308207
If you want to unleash us to all to contact Dynadot, let us know.
I endorse also uploading the generated tarballs as release artefacts (note I am not talking about the "source code" link which has the issues discussed above).
I was in the process of updating the recipe for Conan, but I am still getting SSL cert at https://distfiles.ariadne.space/pkgconf/
Recommendations?
I was in the process of updating the recipe for Conan, but I am still getting SSL cert at https://distfiles.ariadne.space/pkgconf/
That's odd... SSL cert seems fine.