Failed to download sources: module gc: Wrong sha256 checksum for gc-8.0.6.tar.gz

1

I have a weird problem when building below flatpak.
What does this mean exactly?

Failed to download sources: module gc: Wrong sha256 checksum for gc-8.0.6.tar.gz, expected "315daf18ed0e84859eed5a9816153c78ada1b844a095385978d5d284838f1efc", was "3b4914abc9fa76593596773e4da671d7ed4d5390e3d46fbf2e5f155e121bea11"

3b4914 is indeed the old sha256 checksum. See this old build of another similar app:

$ locate gc-8.0.6.tar.gz
/home/fede/src/flathub.org/org.denemo.Denemo/.flatpak-builder/downloads/3b4914abc9fa76593596773e4da671d7ed4d5390e3d46fbf2e5f155e121bea11/gc-8.0.6.tar.gz

If you use wget to download the tarball, the checksum is indeed 315daf18ed0e84859eed5a9816153c78ada1b844a095385978d5d284838f1efc.

I tried everything to clean the cache but did not help. Eventually as a workaround I copied the tarball in the working dir and used a path instead of the url in the manifest.

Some problem with flatpak-builder download and/or cache? Probably not cache, as it seems the tarball is downloaded again, but it does not help.

Here the full log:

$ flatpak run --command=flathub-build org.flatpak.Builder --install org.frescobaldi.Frescobaldi.yaml
Running: flatpak-builder --verbose --force-clean --sandbox --keep-build-dirs --override-source-date-epoch 1321009871 --user --install-deps-from=flathub --ccache --mirror-screenshots-url=https://dl.flathub.org/media --repo=repo builddir --install org.frescobaldi.Frescobaldi.yaml

[...]

Downloading sources
Downloading https://www.hboehm.info/gc/gc_source/gc-8.0.6.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1141k  100 1141k    0     0   934k      0  0:00:01  0:00:01 --:--:--  935k
Failed to download sources: module gc: Wrong sha256 checksum for gc-8.0.6.tar.gz, expected "315daf18ed0e84859eed5a9816153c78ada1b844a095385978d5d284838f1efc", was "3b4914abc9fa76593596773e4da671d7ed4d5390e3d46fbf2e5f155e121bea11"
2

The workaround doesn’t work either:

========================================================================
Building module gc in /home/fede/src/flathub.org/org.frescobaldi.Frescobaldi/.flatpak-builder/build/gc-1
========================================================================
FB: Running: tar xf /home/fede/src/flathub.org/org.frescobaldi.Frescobaldi/gc-8.0.6.tar.gz --no-same-owner --strip-components=1 -z
tar: This does not look like a tar archive
tar: Skipping to next header
tar: Exiting with failure status due to previous errors
Error: module gc: Processo figlio uscito con codice 2
FB: Unmounting read-only fs: fusermount -uz /home/fede/src/flathub.org/org.frescobaldi.Frescobaldi/.flatpak-builder/rofiles/rofiles-wdHw2b

I’ll try to use the latest version tarball. Why I didn’t do this before?

3

No way:

Downloading sources
Downloading https://www.hboehm.info/gc/gc_source/gc-8.2.8.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1190k  100 1190k    0     0   901k      0  0:00:01  0:00:01 --:--:--  900k
Failed to download sources: module gc: Wrong sha256 checksum for gc-8.2.8.tar.gz, expected "d0d0241c95996985d7ddda5622ac4b0b36e5a1cf4ecf36610dd2e2b92f774cf0", was "7649020621cb26325e1fb5c8742590d92fb48ce5c259b502faf7d9fb5dabb160"

But now I realize I was not reading the message correctly. Sorry for the noise.
If I use the second checksum, the build continues.

So the question is: why I get a different sha256sum locally?