Archived issue #0029397

GitWeb produces different snapshot tarballs for the same commit

CommunityWebsite:Gitclosed2 public notes

Search issues

Description

The problem has been reported by external user:

~~~~~

If I run the following two times in a row, I will get a different sha - note I am specify the V7_2_0 tag.

$ curl -L -o opencascade-7.2.0.tgz "http://git.dev.opencascade.org/gitweb/?p=occt.git;a=snapshot;h=refs/tags/V7_2_0;sf=tgz"
$ openssl sha -sha256 opencascade-7.2.0.tgz
SHA256(opencascade-7.2.0.tgz)= 7aecff59b9f4bc3dda87059c7b91f6d6be1ff0f4d80aef2704e11df51cc4dd1e
$ curl -L -o opencascade-7.2.0.tgz "http://git.dev.opencascade.org/gitweb/?p=occt.git;a=snapshot;h=refs/tags/V7_2_0;sf=tgz"
$ openssl sha -sha256 opencascade-7.2.0.tgz
SHA256(opencascade-7.2.0.tgz)= 0747951dee19c4fc644843d90218349e5d3192500da5282f5d3a923fe9c77448

So the tarball creation/download process must mutate the tarball slightly, even when used for a static tag like V7_2_0. Perhaps there is a configuration setting on the occt server that could be set to ensure that downloading a tagged snapshot will always produce an identical tarball?

~~~~~

The reason of this problem is a bug in GitWeb: it calls gzip without option "-n", so it adds timestamp in the archive each time it is generated. See http://git.661346.n2.nabble.com/PATCH-supply-n-to-gzip-to-produce-identical-tarballs-td6258329.html

Steps to reproduce

Download archive from URL
http://git.dev.opencascade.org/gitweb/?p=occt.git;a=snapshot;h=refs/tags/V7_2_0;sf=tgz
several times and compute check sum of these archives -- they should be equal

Public activity

2 archived notes

Participants are labeled by their role within this record.

01Commenter 1
The problem is fixed by adding option "-n" to call to gzip in gitweb.cgi settings
02Commenter 2
Checksums are now stable. For archive downloaded by URL http://git.dev.opencascade.org/gitweb/?p=occt.git;a=snapshot;h=refs/tags/V7_2_0;sf=tgz

> md5sum occt-V7_2_0.tar.gz
[revision removed] *occt-V7_2_0.tar.gz

> openssl sha -sha256 occt-V7_2_0.tar.gz
SHA256(occt-V7_2_0.tar.gz)= adb6fc44efebdb09e30a487fa412afae9599992dc771b0039b4e
bf306891a558