morphix-devel

[Morphix-devel] Morphix Repository - .deb Hash Sum mismatch

[Brendan S. <me...@ba...>]

Hi Alex et al,

Regarding the error seen in sid main-module autobuilds but not etch;
".deb  Hash Sum mismatch"
  http://www.morphix.org/autobuilds/mainmod/sid/morphix-gnome-2007-11-25_0416.log
  http://www.morphix.org/autobuilds/mainmod/etch/morphix-gnome-2007-11-25_0018.log

I notice that each packages in the morphix packages list are now
signed with SHA256, but the release file hs not been signed with
SHA256.
  http://www.morphix.org/debian/unstable/Packages.gz
  http://www.morphix.org/debian/unstable/Release

I think sid requires both the Package and Releases files to be signed
by sha256 now, since apt 0.7.7
http://packages.debian.org/changelogs/pool/main/a/apt/apt_0.7.9/changelog

Sorry do not have a sid machine at the moment to verify, but this is my guess.

'nextime' solved the 'Hash Sum' error for this it for his repository
by forcing to check for md5sum, which his release file was signed
against.

Regards,
Brendan

Re: [Morphix-devel] Morphix Repository - .deb Hash Sum mismatch

[Alex de L. <al...@de...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Brendan,

Brendan Sleight wrote:
> I notice that each packages in the morphix packages list are now
> signed with SHA256, but the release file hs not been signed with
> SHA256.

SHA256 wasn't in mini-dinstall, but I've hacked it in (and sent a patch
to the maintainers).

Hope this works now, if not please let me know!

cheers,

Alex

PS. new m-i-matchbox package also uploaded
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHSznvQeuQA5TF/UsRAiHvAJ9eV3NAi0e8zSkAIJM3EZIIU2Sw6ACePsmn
Fbm7VDOSsPGQIg4hdhkg8Lk=
=ZBwW
-----END PGP SIGNATURE-----