Skip to contentSkip to conversation

Update github hashes

PATCH Superseded Bernd Kuhls 5 participants 10 messages Sep 20, 2017 – Sep 21, 2017

Subsystems (2)
Arm i.MX and Layerscape Arm/Allwinner sunXi SoC support

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Bernd Kuhls

author
#0 lore raw

PATCH 1/1 Update github hashes

It seems github now sometimes provides slightly changed tarballs which produce a different sha256 hash than before. Fix the hashes of the affected packages to avoid downloading from sources.buildroot.net.

Signed-off-by Bernd Kuhls <[email protected]>
---
 package/freerdp/freerdp.hash                                            | 2 +-
 .../kernel-module-imx-gpu-viv/kernel-module-imx-gpu-viv.hash            | 2 +-
 .../kodi-screensaver-crystalmorph/kodi-screensaver-crystalmorph.hash    | 2 +-
 package/kodi/kodi.hash                                                  | 2 +-
 package/libasplib/libasplib.hash                                        | 2 +-
 package/mongoose/mongoose.hash                                          | 2 +-
 package/python-mwscrape2slob/python-mwscrape2slob.hash                  | 2 +-
 package/rpi-userland/rpi-userland.hash                                  | 2 +-
 package/sunxi-cedarx/sunxi-cedarx.hash                                  | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)
package/freerdp/freerdp.hash +1 -1
index 2ced373b38..a713f77bb8 100644
@@ -1,2 +1,2 @@
 # Locally calculated
-sha256 1db496cca391f76382ef284db2d0306d5c15bf515ee2c964319c22272d969a32  freerdp-17834af7bb378f85a3b3cc4dcadaa5125a337e16.tar.gz
+sha256 a0e3b203bcc0f38fa8b20318f6e5df3661419b119079bd95d737b66dd1ac4205  freerdp-17834af7bb378f85a3b3cc4dcadaa5125a337e16.tar.gz
package/freescale-imx/kernel-module-imx-gpu-viv/kernel-module-imx-gpu-viv.hash +1 -1
index f9d400459e..15d3e347f1 100644
@@ -1,2 +1,2 @@
 # locally computed
-sha256	0d45472a967d747bc1948b0332f77c8cd9f6ec1620b0922e82ca5ddd053b40ea  kernel-module-imx-gpu-viv-a05d9b23b9902f6ce87d23772de2fdb2ecfb37a7.tar.gz
+sha256 f18b826fd25328adf6b4405f48fdf0eaaddc77bb79c0dee76cd8c28aa8ffc078  kernel-module-imx-gpu-viv-a05d9b23b9902f6ce87d23772de2fdb2ecfb37a7.tar.gz
package/kodi-screensaver-crystalmorph/kodi-screensaver-crystalmorph.hash +1 -1
index ff9d6d0244..1d0ef080a6 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 a8400c8d8be0fe0ba616ad1d0ef5fd798980a9dd4e38ef88bee9bf74a06975d5  kodi-screensaver-crystalmorph-1dc9bf3f57cc2c5345efec64d9499c3bf8f7bd6e.tar.gz
+sha256 b99aa6295c8dc6afd0dd22991e611ecc8e9b97aff3a44b905911515609e903ea  kodi-screensaver-crystalmorph-1dc9bf3f57cc2c5345efec64d9499c3bf8f7bd6e.tar.gz
package/kodi/kodi.hash +1 -1
index 6c7cf8f615..0dc46133ee 100644
@@ -1,5 +1,5 @@
 # Locally computed
-sha256 b05e11b2d108222bfc3ff0c9a466d798c0feedf1228166239948e6ed37c3cb4f  kodi-17.4-Krypton.tar.gz
+sha256 6b0886e7449fc201e0ec0584b37f9f654c429797a41e6d0b6a4b5a7fd5ec34dc  kodi-17.4-Krypton.tar.gz
 # Locally computed - libdvdcss
 sha256 b6eb2d929ff56cb051152c32010afc5e7cf5fe8c5ae32dca412a2b46b6b57e34  2f12236.tar.gz
 # Locally computed - libdvdnav
package/libasplib/libasplib.hash +1 -1
index 76534e528d..df8161489b 100644
@@ -1,2 +1,2 @@
 # Locally calculated
-sha256 68e117348fa17592dde7672477e927119a0e477103ced1d3a57d92e30880a147  libasplib-be7fac89218a84b75f7598e3d76625ece99296f2.tar.gz
+sha256 c97aa3591a2f4c91a8a3d008e1874cf6a4d3fdcdb71e08cf24b391f328b59254  libasplib-be7fac89218a84b75f7598e3d76625ece99296f2.tar.gz
package/mongoose/mongoose.hash +1 -1
index d5252eb687..92bbf80bb9 100644
@@ -1,2 +1,2 @@
 # Locally computed:
-sha256	ccc971298db70963d3f13766c3246a3c36ae7e388acfab7ba2180149d9c8c64f  mongoose-6.7.tar.gz
+sha256 7033c4c9ad0aac2aaa53864ff0bee5468a327a78a3218fb753d55a426a791189  mongoose-6.7.tar.gz
package/python-mwscrape2slob/python-mwscrape2slob.hash +1 -1
index f1f5e4f166..89b32fe679 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 367ffc3203f7eb2cc26211f58c0693526652d9a238af48c88f936920e804faf7  python-mwscrape2slob-0f9124ed62009dff6a230947d80340f5a61a6f49.tar.gz
+sha256 2b111d6faba4e439fdd383da952f3e8fb5760fc6794a9d1ef5dc6f0e080afe7f  python-mwscrape2slob-0f9124ed62009dff6a230947d80340f5a61a6f49.tar.gz
package/rpi-userland/rpi-userland.hash +1 -1
index 1728ae8712..e8a78b95fa 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 476cde13d0d4bbf44ffc4d1d545847464d5c270bb72e4d940e43e5972c4de9da rpi-userland-29835184aa70c13d77a11d721e934a7298bdf46a.tar.gz
+sha256 46a37eaf0de598ce5804e48a5efc2120e07d753a57ed83463ebfa551562eefe6 rpi-userland-29835184aa70c13d77a11d721e934a7298bdf46a.tar.gz
package/sunxi-cedarx/sunxi-cedarx.hash +1 -1
index 048b868982..f40a6449fc 100644
@@ -1,2 +1,2 @@
 # locally computed
-sha256  ea7426f83325d247ba0d4734eaf1cb53bab178a81f935e2535ddb3069f70ba84  sunxi-cedarx-b8f52d913f73720e50d8f1b2f8610467b575dc45.tar.gz
+sha256  e674a3b88b12cabc0aaa97c9fdcd898b712daedb549eb49bbf6d1c851c0791f0  sunxi-cedarx-b8f52d913f73720e50d8f1b2f8610467b575dc45.tar.gz
Signature · 1 line
2.11.0
#1 lore raw

PATCH 1/1 Update github hashes

Bernd, All,

On 2017-09-20 13:28 +0200, Bernd Kuhls spake thusly:

Quoted 3 lines

It seems github now sometimes provides slightly changed tarballs which produce a different sha256 hash than before. Fix the hashes of the affected packages to avoid downloading from sources.buildroot.net.

Sigh...

Quoted 1 line
Signed-off-by Bernd Kuhls <[email protected]>
Tested-by "Yann E. MORIN" <[email protected]>
Reviewed-by "Yann E. MORIN" <[email protected]>

Regards,
Yann E. MORIN.

Quoted 90 lines
---
 package/freerdp/freerdp.hash                                            | 2 +-
 .../kernel-module-imx-gpu-viv/kernel-module-imx-gpu-viv.hash            | 2 +-
 .../kodi-screensaver-crystalmorph/kodi-screensaver-crystalmorph.hash    | 2 +-
 package/kodi/kodi.hash                                                  | 2 +-
 package/libasplib/libasplib.hash                                        | 2 +-
 package/mongoose/mongoose.hash                                          | 2 +-
 package/python-mwscrape2slob/python-mwscrape2slob.hash                  | 2 +-
 package/rpi-userland/rpi-userland.hash                                  | 2 +-
 package/sunxi-cedarx/sunxi-cedarx.hash                                  | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)
package/freerdp/freerdp.hash +1 -1
index 2ced373b38..a713f77bb8 100644
@@ -1,2 +1,2 @@
 # Locally calculated
-sha256 1db496cca391f76382ef284db2d0306d5c15bf515ee2c964319c22272d969a32  freerdp-17834af7bb378f85a3b3cc4dcadaa5125a337e16.tar.gz
+sha256 a0e3b203bcc0f38fa8b20318f6e5df3661419b119079bd95d737b66dd1ac4205  freerdp-17834af7bb378f85a3b3cc4dcadaa5125a337e16.tar.gz
package/freescale-imx/kernel-module-imx-gpu-viv/kernel-module-imx-gpu-viv.hash +1 -1
index f9d400459e..15d3e347f1 100644
@@ -1,2 +1,2 @@
 # locally computed
-sha256	0d45472a967d747bc1948b0332f77c8cd9f6ec1620b0922e82ca5ddd053b40ea  kernel-module-imx-gpu-viv-a05d9b23b9902f6ce87d23772de2fdb2ecfb37a7.tar.gz
+sha256 f18b826fd25328adf6b4405f48fdf0eaaddc77bb79c0dee76cd8c28aa8ffc078  kernel-module-imx-gpu-viv-a05d9b23b9902f6ce87d23772de2fdb2ecfb37a7.tar.gz
package/kodi-screensaver-crystalmorph/kodi-screensaver-crystalmorph.hash +1 -1
index ff9d6d0244..1d0ef080a6 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 a8400c8d8be0fe0ba616ad1d0ef5fd798980a9dd4e38ef88bee9bf74a06975d5  kodi-screensaver-crystalmorph-1dc9bf3f57cc2c5345efec64d9499c3bf8f7bd6e.tar.gz
+sha256 b99aa6295c8dc6afd0dd22991e611ecc8e9b97aff3a44b905911515609e903ea  kodi-screensaver-crystalmorph-1dc9bf3f57cc2c5345efec64d9499c3bf8f7bd6e.tar.gz
package/kodi/kodi.hash +1 -1
index 6c7cf8f615..0dc46133ee 100644
@@ -1,5 +1,5 @@
 # Locally computed
-sha256 b05e11b2d108222bfc3ff0c9a466d798c0feedf1228166239948e6ed37c3cb4f  kodi-17.4-Krypton.tar.gz
+sha256 6b0886e7449fc201e0ec0584b37f9f654c429797a41e6d0b6a4b5a7fd5ec34dc  kodi-17.4-Krypton.tar.gz
 # Locally computed - libdvdcss
 sha256 b6eb2d929ff56cb051152c32010afc5e7cf5fe8c5ae32dca412a2b46b6b57e34  2f12236.tar.gz
 # Locally computed - libdvdnav
package/libasplib/libasplib.hash +1 -1
index 76534e528d..df8161489b 100644
@@ -1,2 +1,2 @@
 # Locally calculated
-sha256 68e117348fa17592dde7672477e927119a0e477103ced1d3a57d92e30880a147  libasplib-be7fac89218a84b75f7598e3d76625ece99296f2.tar.gz
+sha256 c97aa3591a2f4c91a8a3d008e1874cf6a4d3fdcdb71e08cf24b391f328b59254  libasplib-be7fac89218a84b75f7598e3d76625ece99296f2.tar.gz
package/mongoose/mongoose.hash +1 -1
index d5252eb687..92bbf80bb9 100644
@@ -1,2 +1,2 @@
 # Locally computed:
-sha256	ccc971298db70963d3f13766c3246a3c36ae7e388acfab7ba2180149d9c8c64f  mongoose-6.7.tar.gz
+sha256 7033c4c9ad0aac2aaa53864ff0bee5468a327a78a3218fb753d55a426a791189  mongoose-6.7.tar.gz
package/python-mwscrape2slob/python-mwscrape2slob.hash +1 -1
index f1f5e4f166..89b32fe679 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 367ffc3203f7eb2cc26211f58c0693526652d9a238af48c88f936920e804faf7  python-mwscrape2slob-0f9124ed62009dff6a230947d80340f5a61a6f49.tar.gz
+sha256 2b111d6faba4e439fdd383da952f3e8fb5760fc6794a9d1ef5dc6f0e080afe7f  python-mwscrape2slob-0f9124ed62009dff6a230947d80340f5a61a6f49.tar.gz
package/rpi-userland/rpi-userland.hash +1 -1
index 1728ae8712..e8a78b95fa 100644
@@ -1,2 +1,2 @@
 # Locally computed
-sha256 476cde13d0d4bbf44ffc4d1d545847464d5c270bb72e4d940e43e5972c4de9da rpi-userland-29835184aa70c13d77a11d721e934a7298bdf46a.tar.gz
+sha256 46a37eaf0de598ce5804e48a5efc2120e07d753a57ed83463ebfa551562eefe6 rpi-userland-29835184aa70c13d77a11d721e934a7298bdf46a.tar.gz
package/sunxi-cedarx/sunxi-cedarx.hash +1 -1
index 048b868982..f40a6449fc 100644
@@ -1,2 +1,2 @@
 # locally computed
-sha256  ea7426f83325d247ba0d4734eaf1cb53bab178a81f935e2535ddb3069f70ba84  sunxi-cedarx-b8f52d913f73720e50d8f1b2f8610467b575dc45.tar.gz
+sha256  e674a3b88b12cabc0aaa97c9fdcd898b712daedb549eb49bbf6d1c851c0791f0  sunxi-cedarx-b8f52d913f73720e50d8f1b2f8610467b575dc45.tar.gz
Signature · 1 line
2.11.0
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
#2 lore raw

PATCH 1/1 Update github hashes

In reply to Bernd Kuhls
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

It seems github now sometimes provides slightly changed tarballs which produce a different sha256 hash than before. Fix the hashes of the affected packages to avoid downloading from sources.buildroot.net.

Signed-off-by Bernd Kuhls <[email protected]>

:/

I'm not sure updating the hashes is the correct thing to do. Sources.b.o runs 'make source' from the 2017.02.x and master branches to keep it uptodate, and E.G. freerdp hasn't been updated since 2017.02, so it will break hard for 2017.02.x users if we change it.

Falling back to s.b.o is not such a bad thing, so I think we can wait with fixing up the hashes until the packages get bumped.

In the mean time I will try to figure out who to contact at github to ask about the change.

Signature · 1 line
Bye, Peter Korsgaard
#3 lore raw

PATCH 1/1 Update github hashes

All,

Quoted 15 lines · Peter Korsgaard
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

It seems github now sometimes provides slightly changed tarballs which produce a different sha256 hash than before. Fix the hashes of the affected packages to avoid downloading from sources.buildroot.net.

Signed-off-by Bernd Kuhls <[email protected]>

:/

I'm not sure updating the hashes is the correct thing to do. Sources.b.o runs 'make source' from the 2017.02.x and master branches to keep it uptodate, and E.G. freerdp hasn't been updated since 2017.02, so it will break hard for 2017.02.x users if we change it.

Quoted 6 lines

Falling back to s.b.o is not such a bad thing, so I think we can wait with fixing up the hashes until the packages get bumped.

In the mean time I will try to figure out who to contact at github to ask about the change.

I'd second it would be better to wait. The iperf hash issue earlier this summer created a mess until that was bumped.

Signature · 8 lines
Matthew L Weber / Pr Software Engineer
Airborne Information Systems / Security Systems and Software / Secure Platforms
MS 131-100, C Ave NE, Cedar Rapids, IA, 52498, USA
www.rockwellcollins.com

Note: Any Export License Required Information and License Restricted
Third Party Intellectual Property (TPIP) content must be encrypted and
sent to matthew.weber at corp.rockwellcollins.com.
author
#4 lore raw

PATCH 1/1 Update github hashes

Am Wed, 20 Sep 2017 13:03:32 -0500 schrieb Matthew Weber:

Quoted 25 lines

All,

Quoted 21 lines · Peter Korsgaard
Quoted 10 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

"Bernd" == Bernd Kuhls
<[email protected]> writes:

It seems github now sometimes provides slightly changed tarballs which produce a different sha256 hash than before. Fix the hashes of the affected packages to avoid downloading from sources.buildroot.net.

Signed-off-by: Bernd Kuhls
<[email protected]>

:/

I'm not sure updating the hashes is the correct thing to do. Sources.b.o runs 'make source' from the 2017.02.x and master branches to keep it uptodate, and E.G. freerdp hasn't been updated since 2017.02, so it will break hard for 2017.02.x users if we change it.

Falling back to s.b.o is not such a bad thing, so I think we can wait with fixing up the hashes until the packages get bumped.

Quoted 6 lines
Quoted 4 lines

In the mean time I will try to figure out who to contact at github to ask about the change.

I'd second it would be better to wait. The iperf hash issue earlier this summer created a mess until that was bumped.

Hi,

I do not see a perfect solution for this problem, the fallback to s.b.o. will not circumvent download failures because it does not provide source tarballs for all packages:

$ LC_ALL=C wget sources.buildroot.org/kodi-17.4-Krypton.tar.gz
--2017-09-20 20:23:27--  http://sources.buildroot.org/kodi-17.4-
Krypton.tar.gz
Resolving sources.buildroot.org (sources.buildroot.org)... 176.9.16.109
Connecting to sources.buildroot.org (sources.buildroot.org)|
176.9.16.109|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2017-09-20 20:23:27 ERROR 404: Not Found.

Not committing this patch means that downloading the kodi package will always fail. Otoh I recognize the mess for the lts versions...

Additionally not all users are using BR2_BACKUP_SITE="http://sources.buildroot.net"
in their setup, I normally deactivate this option to save bandwidth and to be informed when upstream did changes to its website.

Regards, Bernd

#5 lore raw

PATCH 1/1 Update github hashes

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

Hi,

Quoted 13 lines

I do not see a perfect solution for this problem, the fallback to s.b.o. will not circumvent download failures because it does not provide source tarballs for all packages:

$ LC_ALL=C wget sources.buildroot.org/kodi-17.4-Krypton.tar.gz
--2017-09-20 20:23:27--  http://sources.buildroot.org/kodi-17.4-
Krypton.tar.gz
Resolving sources.buildroot.org (sources.buildroot.org)... 176.9.16.109
Connecting to sources.buildroot.org (sources.buildroot.org)|
176.9.16.109|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2017-09-20 20:23:27 ERROR 404: Not Found.
Quoted 2 lines

Not committing this patch means that downloading the kodi package will always fail. Otoh I recognize the mess for the lts versions...

Odd that hasn't been downloaded yet, but kodi was only very recently bumped (post-2017.08), so there's no problem fixing the hash there.

Can you send a patch only fixing the kodi hash?

Quoted 4 lines

Additionally not all users are using BR2_BACKUP_SITE="http://sources.buildroot.net"
in their setup, I normally deactivate this option to save bandwidth and to be informed when upstream did changes to its website.

Save bandwidth? I can understand disabling the option for development reasons, but this is exactly the reason why we are running the mirror in the first place and I wouldn't recommend disabling the option for "normal" users.

Signature · 1 line
Bye, Peter Korsgaard
author
#6 lore raw

PATCH 1/1 Update github hashes

Am Thu, 21 Sep 2017 09:23:46 +0200 schrieb Peter Korsgaard:

Quoted 10 lines
Quoted 5 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

"Bernd" == Bernd Kuhls
<[email protected]> writes:

Not committing this patch means that downloading the kodi package will always fail. Otoh I recognize the mess for the lts versions...

Odd that hasn't been downloaded yet, but kodi was only very recently bumped (post-2017.08), so there's no problem fixing the hash there.

Can you send a patch only fixing the kodi hash?

Hi Peter,

sent http://patchwork.ozlabs.org/patch/816774/ which updates only those packages where sources.buildroot.net does not store a copy of the previous tarball, not only kodi was affected.

Regarding the build of kodi by autobuilders I think it currently does not happen unless at least one of the autobuilders has a full-blown jdk installed.

Regards, Bernd

#7 lore raw

PATCH 1/1 Update github hashes

Quoted 12 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Bernd" == Bernd Kuhls <[email protected]> writes:

Am Thu, 21 Sep 2017 09:23:46 +0200 schrieb Peter Korsgaard:

Quoted 9 lines
Quoted 5 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines

"Bernd" == Bernd Kuhls
<[email protected]> writes:

Not committing this patch means that downloading the kodi package will always fail. Otoh I recognize the mess for the lts versions...

Odd that hasn't been downloaded yet, but kodi was only very recently bumped (post-2017.08), so there's no problem fixing the hash there.

Quoted 7 lines
Quoted 1 line

Can you send a patch only fixing the kodi hash?

Hi Peter,

sent http://patchwork.ozlabs.org/patch/816774/ which updates only those packages where sources.buildroot.net does not store a copy of the previous tarball, not only kodi was affected.

Thanks!

Quoted 3 lines

Regarding the build of kodi by autobuilders I think it currently does not happen unless at least one of the autobuilders has a full-blown jdk installed.

Ahh, and that also explains why the tarball wasn't on our mirror - That machine also doesn't have a jdk.

I'll manually put the tarball there now.

Signature · 1 line
Bye, Peter Korsgaard
#8 lore raw

PATCH 1/1 Update github hashes

In reply to Peter Korsgaard
Quoted 4 lines · Peter Korsgaard

I'm not sure updating the hashes is the correct thing to do. Sources.b.o runs 'make source' from the 2017.02.x and master branches to keep it uptodate, and E.G. freerdp hasn't been updated since 2017.02, so it will break hard for 2017.02.x users if we change it.

So perhaps a workaround would be to change the hashes to none instead? That way
sources.b.o will retain the original tarballs (since they still have the "correct" hash).

Not changing the hash gives the problem that the packages are downloaded twice:
once from github, failing hash, and then again from sources.b.o. For 2017.02.x users that's unavoidable, but for master users we can fix it by changing the hash to none.

Of course, the hash file should then have a comment explaining that the hash
should be updated again when the package is bumped.

Regards,
Arnout

Signature · 6 lines
Arnout Vandecappelle                          arnout at mind be
Senior Embedded Software Architect            +32-16-286500
Essensium/Mind                                http://www.mind.be
G.Geenslaan 9, 3001 Leuven, Belgium           BE 872 984 063 RPR Leuven
LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle
GPG fingerprint:  7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
#9 lore raw

PATCH 1/1 Update github hashes

Quoted 12 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Arnout" == Arnout Vandecappelle <[email protected]> writes:

Quoted 4 lines · Peter Korsgaard

I'm not sure updating the hashes is the correct thing to do. Sources.b.o runs 'make source' from the 2017.02.x and master branches to keep it uptodate, and E.G. freerdp hasn't been updated since 2017.02, so it will break hard for 2017.02.x users if we change it.

So perhaps a workaround would be to change the hashes to none instead? That way
sources.b.o will retain the original tarballs (since they still have the "correct" hash).

Quoted 7 lines

Not changing the hash gives the problem that the packages are downloaded twice:
once from github, failing hash, and then again from sources.b.o. For 2017.02.x users that's unavoidable, but for master users we can fix it by changing the hash to none.

Of course, the hash file should then have a comment explaining that the hash
should be updated again when the package is bumped.

Yes, that or simply bumping the version on master (or wait for feedback from github).

Signature · 1 line
Bye, Peter Korsgaard