osslsigncode 1.7.1 checksum no longer matches #21416

I am trying to Gitian build Bitcoin Core 0.18.1. This version of Core uses osslsigncode 1.7.1, and the Gitian build script checks the checksum with a hardcoded value before proceeding. The checksums do not match.

Expected behavior

Expected checksum: f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9

Actual behavior

Actual checksum: ec2c82f1a1241b4c4b1c261c08bfd098542d0b73f24ef130b3e1af1fced42b1c

To reproduce

Followed the gitian building instructions, setup via gitian-build.py script and trying to build via script.

System information

Bitcoin Core 0.18.1 Ubuntu 16 LTS Brand new DigitalOcean VM

Can replicate on Ubuntu 16 gitian building off of the 0.18.1 branch

subprocess.CalledProcessError: Command '["echo 'f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9 inputs/osslsigncode-1.7.1.tar.gz' | sha256sum -c"]' returned non-zero exit status 1

I get a different hash than you for the osslsigncode-1.7.1.tar.gz file:

$ sha256sum inputs/osslsigncode-1.7.1.tar.gz

d96143f051396ea01da8a7293f8f68bc90850d643f8f0db658c0d7f8658bfe3d  inputs/osslsigncode-1.7.1.tar.gz

@fanquake how would something like this go about being fixed? is it backporting the correct sha256sum into the 0.18 branch?

@jarolrod 0.18 is end of life, so we may not backport anything. If someone wants to work out why the checksum has changed, and why it's currently unstable, that may be worthwhile.

@DrahtBot ran into this as well:

Building Dependencies

--2021-03-17 14:42:43--  https://downloads.sourceforge.net/project/osslsigncode/osslsigncode/osslsigncode-1.7.1.tar.gz
Resolving downloads.sourceforge.net (downloads.sourceforge.net)... 216.105.38.13
Connecting to downloads.sourceforge.net (downloads.sourceforge.net)|216.105.38.13|:443... connected.
HTTP request sent, awaiting response... 307 Temporary Redirect
Location: https://sourceforge.net/downloads [following]
--2021-03-17 14:42:43--  https://sourceforge.net/downloads
Resolving sourceforge.net (sourceforge.net)... 216.105.38.13
Connecting to sourceforge.net (sourceforge.net)|216.105.38.13|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://sourceforge.net/publish [following]
--2021-03-17 14:42:43--  https://sourceforge.net/publish
Reusing existing connection to sourceforge.net:443.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://sourceforge.net/publish/ [following]
--2021-03-17 14:42:44--  https://sourceforge.net/publish/
Reusing existing connection to sourceforge.net:443.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://sourceforge.net/create [following]
--2021-03-17 14:42:44--  https://sourceforge.net/create
Reusing existing connection to sourceforge.net:443.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://sourceforge.net/create/ [following]
--2021-03-17 14:42:44--  https://sourceforge.net/create/
Reusing existing connection to sourceforge.net:443.
HTTP request sent, awaiting response... 200 OK
Length: 130215 (127K) [text/html]
Saving to: ‘inputs/osslsigncode-1.7.1.tar.gz’

osslsigncode-1.7.1.tar.gz                                   100%[=========================================================================================================================================>] 127.16K  --.-KB/s    in 0.06s

Last-modified header missing -- time-stamps turned off.
2021-03-17 14:42:44 (2.10 MB/s) - ‘inputs/osslsigncode-1.7.1.tar.gz’ saved [130215/130215]

--2021-03-17 14:42:44--  https://bitcoincore.org/cfields/osslsigncode-Backports-to-1.7.1.patch
Resolving bitcoincore.org (bitcoincore.org)... 107.191.99.5, 198.251.83.116
Connecting to bitcoincore.org (bitcoincore.org)|107.191.99.5|:443... connected.
HTTP request sent, awaiting response... 304 Not Modified
File ‘inputs/osslsigncode-Backports-to-1.7.1.patch’ not modified on server. Omitting download.

inputs/osslsigncode-Backports-to-1.7.1.patch: OK
inputs/osslsigncode-1.7.1.tar.gz: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
Traceback (most recent call last):
  File "/home/micap/temp/scripts/gitian-build.py", line 253, in <module>
    main()
  File "/home/micap/temp/scripts/gitian-build.py", line 241, in main
    build()
  File "/home/micap/temp/scripts/gitian-build.py", line 50, in build
    subprocess.check_call(["echo 'f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9 inputs/osslsigncode-1.7.1.tar.gz' | sha256sum -c"], shell=True)

$ file osslsigncode-1.7.1.tar.gz 
osslsigncode-1.7.1.tar.gz: HTML document, UTF-8 Unicode text, with very long lines

Here is a mirror of the original file:

• https://github.com/bitcoin/bitcoin/files/6175295/osslsigncode-1.7.1.tar.gz

Closing, unless there is something else that needs to be done here?