Bug 2427929

Summary: libcorrect: sources checksum does not match
Product: [Fedora] Fedora Reporter: Cristian Le <fedora>
Component: libcorrectAssignee: Vasiliy Glazov <vascom2>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: rawhideCC: dreua, vascom2
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
URL: https://copr.fedorainfracloud.org/coprs/lecris/cmake-4.0-recheck/build/9986584/
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2380713    

Description Cristian Le 2026-01-08 14:32:05 UTC
I tried to rebuild this package recently in copr, but it hit a checksum failure. Would you look into this issue? If not I can help with a PR investigating this after I finish with the CMake 4.0 change, just assign this bug to me.

https://copr.fedorainfracloud.org/coprs/lecris/cmake-4.0-recheck/build/9986584/

Reproducible: Always

Comment 1 David Auer 2026-06-05 16:12:32 UTC
The copr build has been purged, but I had the same issue with a local build.

$ fedpkg mockbuild 
Downloading f5a28c74fba7a99736fe49d3a5243eca29517ae9 from https://src.fedoraproject.org/repo/pkgs

Could not execute mockbuild: Could not download sources: f5a28c74fba7a99736fe49d3a5243eca29517ae9 failed checksum

Let's try downloading from upstream:
$ spectool -g libcorrect.spec 
Downloading: https://github.com/quiet/libcorrect/tarball/f5a28c74fba7a99736fe49d3a5243eca29517ae9
File '/home/da/fedora-scm/libcorrect/f5a28c74fba7a99736fe49d3a5243eca29517ae9' already present.

It was already there, the mockbuild downloaded it successfully but still was unhappy.

I removed that file and downloaded again with spectool, which succeeded. The newly downloaded file matches the checksum in sources.
The file from dist-git did not match the checksum, it is much larger and only a tar archive, while the new file is gzipped. When unpacked, meld says that the directories are the same.

No idea how all of that happened. When I delete the source file and download it via spectool a subsequent mockbuild runs just fine. (It skips the mismatch between source file and the source bundle dist-git.)

Note that the name of this source bundle is a bit hard to grasp, I think we can get better results with a different path on Github, I'll look into that.

Comment 2 David Auer 2026-06-05 16:30:42 UTC
I don't think I can overwrite the sources uploaded to dist-git:

$ fedpkg new-sources f5a28c74fba7a99736fe49d3a5243eca29517ae9 
Uploading: f5a28c74fba7a99736fe49d3a5243eca29517ae9 to https://src.fedoraproject.org/repo/pkgs/upload.cgi
File already uploaded: f5a28c74fba7a99736fe49d3a5243eca29517ae9
All sources were already uploaded.

(Never needed to do that before, I guess it makes sense to deny that in general.)

The minimal fix would be to change the hash in the source file to match what currently is in dist-git or to upload the source under a different name.


I think while we're at it we could also:
- Name the source bundle better like noted in my previous comment.
- Update to the latest upstream commit. The changes are minor but would allow us to drop the "CMAKE_POLICY_VERSION_MINIMUM=3.5" from the spec file.
- Further clean up the spec file. (License)


Let me know if you want me do do that, I can create a PR.

Also feel free to add me as a co-maintainer (fas: dreua) so I can merge and create updates as necessary and get informed of any upcoming issues in the future.

Comment 3 Cristian Le 2026-06-05 16:39:09 UTC
Please make a PR to point to a more sane path for `url`, something like `https://github.com/quiet/libcorrect/archive/%{sha}.tar.gz`. Note that there are other packages maintained by vascom with a similar issue.

Comment 4 David Auer 2026-06-05 17:10:43 UTC
Actually I meant to ask vascom as he the maintainer and he decides what (not) to merge. But yeah, that sounds sensible and straight forward, might make a PR later anyways.

Comment 6 Vasiliy Glazov 2026-06-10 05:11:37 UTC
PR merged.

Comment 7 David Auer 2026-06-10 15:38:26 UTC
I took the liberty to trigger a build, for rawhide/45. All green now there. For 44 we could do a rebuild but I don't think that is necessary. Is there anything left to do other than closing this issue?