Sha256 incorrect error - but it isn't

1

I have a Flatpak which used to work, then the version of “Boost” referred to in the manifest was archived. So I changed the URL (the sha256 stayed the same as it was the same file) to the new location.

>     sources:
>       - type: archive    
>         #old one https://dl.bintray.com/boostorg/release/1.68.0/source/boost_1_68_0.tar.bz2
>         url: https://boostorg.jfrog.io/ui/native/main/release/1.68.0/source/boost_1_68_0.tar.bz2
>         sha256: 7f6130bc3cf65f56a618888ce9d5ea704fa10b462be126ad053e80e553d6d8b7

This module now fails with flatpak-builder, complaining that the sha256 is incorrect.

Failed to download sources: module boost: Wrong sha256 checksum for boost_1_68_0.tar.bz2, expected “7f6130bc3cf65f56a618888ce9d5ea704fa10b462be126ad053e80e553d6d8b7”, was “4ffd1325229da00455ae95a68de976d053e46315628ffcd57a433238e74e7eab”

I have separately downloaded the file so that I can use sha256sum to check it - and the checksum in the module is correct.

$ sha256sum Downloads/boost_1_68_0.tar.bz2
7f6130bc3cf65f56a618888ce9d5ea704fa10b462be126ad053e80e553d6d8b7 Downloads/boost_1_68_0.tar.bz2

I’ve probably made another newbie error…but the other 8 modules are downloaded and installed without any problems.

2

This is very strange, this is what I get. My sha256sum output matches flatpak-builder’s but not yours.

$ wget https://boostorg.jfrog.io/ui/native/main/release/1.68.0/source/boost_1_68_0.tar.bz2

$ sha256sum boost_1_68_0.tar.bz2 
4ffd1325229da00455ae95a68de976d053e46315628ffcd57a433238e74e7eab  boost_1_68_0.tar.bz2
1 Like
3

@vchernin Don’t take this too seriously because it is late here and I’m tired, and I haven’t been able to give your post the consideration it deserves, but:

boost1
boost1731×431 105 KB

What?

4

I think I found the problem. There are 2 CDN URLs which give files of the same name but with different contents. Presumbably this is a mixup between them, you’ve checked one of these locally and put the other in your Flatpak manifest.

image
image3792×106 24.8 KB 

wget https://boostorg.jfrog.io/ui/native/main/release/1.68.0/source/boost_1_68_0.tar.bz2
4ffd1325229da00455ae95a68de976d053e46315628ffcd57a433238e74e7eab  boost_1_68_0.tar.bz2

wget https://boostorg.jfrog.io/artifactory/main/release/1.68.0/source/boost_1_68_0.tar.bz2
7f6130bc3cf65f56a618888ce9d5ea704fa10b462be126ad053e80e553d6d8b7  boost_1_68_0.tar.bz2
1 Like
5

I was too “tired” last night to spot that you were using a slightly different URL, or that the SHA256 in my post was the one I was looking for. I had tried the latest version of Boost in the past and was getting the same error, I expect that was the same problem.
Boost has now been installed successfully. I doubt whether I would ever have worked this out, so thanks very much!