Closed Bug 345505 Opened 18 years ago Closed 17 years ago

"Install now" button tries to install a corrupt file [error message: Invalid file hash (possible download corruption)]

Categories

(addons.mozilla.org Graveyard :: Public Pages, defect)

Product:
addons.mozilla.org Graveyard
Component:
Public Pages
Type:
defect
Priority:
Not set
Severity:
major

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: pogodin, Assigned: morgamic)

References

(
URL
)

Details

Attachments

(1 file)

Fix for multi-OS add-ons.
2.00 KB, patch
clouserw
: first-review+
Details | Diff | Splinter Review 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

When I try to install the "Celebrity Search" extension on my machine FF1.5, the browser displays the following alert 

Forefox could not install the file at http://releases.mozilla.org/pub/mozilla.org/extensions/celebrity_seatch-0.4+fx+fl.xpi
beacuse: Invalid file hash (possible download corruption). 

However if  you go to "other versions" page https://addons.mozilla.org/firefox/2956/history the same version is downloaded fine.

This happens on all the client machines. 

Please at least re-publish this extension.

Reproducible: Always

Steps to Reproduce:
1. Go to https://addons.mozilla.org/firefox/2956/
2. Click "Install now"
3. Get the message in the browser 
Forefox could not install the file at http://releases.mozilla.org/pub/mozilla.org/extensions/celebrity_seatch-0.4+fx+fl.xpi
beacuse: Invalid file hash (possible download corruption).
4. Go to history page https://addons.mozilla.org/firefox/2956/history
5. Download the same version without any problem from this page

Actual Results:  
Forefox could not install the file at http://releases.mozilla.org/pub/mozilla.org/extensions/celebrity_seatch-0.4+fx+fl.xpi
beacuse: Invalid file hash (possible download corruption).

Expected Results:  
Firefox should have installed the extension
Sounds like our hash isn't right.  Did you download it and then install it, or try to install right from the website?
*** Bug 344949 has been marked as a duplicate of this bug. ***
Assignee: nobody → morgamic
Status: UNCONFIRMED → NEW
Ever confirmed: true
Status: NEW → ASSIGNED
Attached patch Fix for multi-OS add-ons. — — Splinter Review 
The hash should be coming from OsVersions, not the main hash attribute.  This was causing the hash to be the same over all OsVersion iterations when building the install links using JS.
Attachment #230446 - Flags: first-review?(clouserw)
Attachment #230446 - Flags: first-review?(clouserw) → first-review+
Michael, same thing happens with Adblock Plus (https://addons.mozilla.org/firefox/1865/) and it isn't a multi-OS extension - is it a different issue?
Updated description to include error message for easy findability.

I think when you go to "other versions" Firefox gets the xpi from your cache, rather than re-downloading, and thus might not check the hash again?
Summary: "Install now" button tries to install a corrupt file → "Install now" button tries to install a corrupt file [error message: Invalid file hash (possible download corruption)]
Version: unspecified → 2.0
No, the reason why you can install from the "older versions" page is that you have a direct link to the extension there, no fancy InstallTrigger features like hashes. The regular installation has issues however, I'm sure that I didn't have some wrong file in the cache since the download was very visible on my slow connection. The file itself isn't broken, it is exactly the same one I uploaded, so the problem is with the hash in the database.
This should have been fixed.  In Wladimir's case we modified the hash in the db -- let us know if that works.  :)
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
(In reply to comment #7)
> This should have been fixed.  In Wladimir's case we modified the hash in the db
> -- let us know if that works.  :)
> 

We can now download our extension fine.  Thanks for the fix!
Just had two people come into #addons with this error, on https://addons.mozilla.org/firefox/810/ and https://addons.mozilla.org/mozilla/2694/
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
*** Bug 349387 has been marked as a duplicate of this bug. ***
I just had this happen ping addons.mozilla.org returned 63.245.209.31
With the extension in the URL field?  Just want to be sure.  What version were you trying to install?
(In reply to comment #12)
> With the extension in the URL field?  Just want to be sure.  What version were
> you trying to install?

I have this problem on page https://addons.mozilla.org/firefox/2697/ , the current version CrossFTP 1.01
A user just reported this bug installing from https://addons.mozilla.org/addon.php?id=2410

The problem of trying to install an extension that was either installed from the website or downloaded locally first and getting the message "invalid hash"

If you look at many of the most popular extensions you see people having this problem OFTEN and regularly.  

It happens to me with various extensions, and sometimes downloading them locally instead of dynamic installs works, sometimes not.

With Thunderbird, I have one that won't install at all, and it's not from the Mozilla site, so it can't be in the "database"

Logically this means that its in the calculation of the hash or the retaining or comparing operation.

It seems like this would be simple to fix, but someone just needs to find it.
I just had the following happen with Thunderbird Extension AttachmentExtractor:

I went to developer's site and found a pre-release version. (v0.6.7)
I downloaded it to the directory where I keep Thunderbird Extension downloads
I opened Thunderbird and Extension manager, and clicked install
I navigated to the folder and tried installing the pre-release version.
I got the Invalid File Hash error.
I tried this several times, then I removed the original version (v0.6.5)
I tried to install again and got the Invalid File Hash.
I exited from Thunderbird, did some other things, entered the previous comment, and opened Thunderbird.
I went to the Extensions manager, and the new version v0.6.7 was installed.
NOTE: In every case I tried to install it, I got the File Has error.  But on at least one of them, Thunderbird installed it.

So there is something else going on here.
Maybe the wrong message is being displayed?


I also got a report about Adblock Plus not installing in Firefox 1.5.0.7 because of "invalid file hash" - even if using a direct link, without InstallTrigger. I just checked the code, and this should never happen, the only caller that specifies a hash is the JavaScript InstallTrigger object. I'm suspecting data corruption in Gecko, this would also explain another user getting the message "Adblock Plus 0.7.1.2 could not be installed because it is not compatible with Firefox 1.5.0.7. (Adblock Plus 0.7.1.2 will only work with Firefox versions from 1.5 to 3.0a1)".
Created bug 354338 on the issue.
*** Bug 357732 has been marked as a duplicate of this bug. ***
I noticed that Bug 355973 [url=https://bugzilla.mozilla.org/show_bug.cgi?id=355973| ("Bug 355973")[/url] Opened 2006-10-08 14:31 PST, has an identical issue to this thread w/o response or being marked as duplicate.

I also experienced this same issue attempting to download Map+ (https://addons.mozilla.org/firefox/2394/) not too long after updating FF to 1.0.5.9 from 1.0.5.4.  The file successfully installed after restarting FF three times, although there appeared to be no other cause than the hash installer.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.9) Gecko/20061206 Firefox/1.5.0.9

Steps to Reproduce:  
1. Went to Map+ for download https://addons.mozilla.org/firefox/2394/
2. Clicked Download Installer package link = instant error
3. Attempted download several times during two FF restarts, 3rd time was the charm for me (restarting FF that is...)
*** Bug 355973 has been marked as a duplicate of this bug. ***
Crud.  I just responded to another bug for this problem and I don't remember which- I wasn't CC'd on the mail for the post I made.  I'll comment here if anyone responds to that one so it can be marked duplicate.

Anyway, I had pretty much the same issue but slightly more confusing.  After my extensions auto-updated, I started getting a message at Firefox startup stating that "install.rdf" could not be installed because the hash was invalid and there was possible download corruption.  It didn't say which extension, so there wasn't much I could do about it.  I'm still in the middle of rebuilding the computer, so I ignored it until I had some time to mess with it, and a couple of days later it stopped coming up.  I don't know whether it finally got the file or just gave up.

I am using the most recent Firefox 2.0.0.1, but I'm not sure if this was before or after the .1 got added.  I have _way_ too many extensions to be sure which one was the culprit, but I do have Adblock Plus, so that might be it.  I'll repost if I get the message again.
Quinn is referring to bug 354338 comment 2 but these two bugs are very different. And no single extension can be responsible for it, it should be rather a bug in XPInstall.
Could this be the same cause of Bug 333335?
(In reply to comment #24)
> Could this be the same cause of Bug 333335?

And by Bug 333335, I mean Bug 373514.
No, this bug is about AMO 2.0, not preview.
Another extension with wrong hash: https://addons.mozilla.org/en-US/firefox/addon/1203 (cannot update in my Thunderbird because of this). Hash in the database is sha1:ab0ac18555a6833271a24b100ceb98b473c91ae0, my sha1sum shows sha1:bc93013e8c7826a52bea548e3c64d4f1a0b696e3 for the file however. Posting it here since this hash came from the AMOv2 database, not a Remora bug AFAICT.
Wladimir: I updated the hash for Correct Identity's version -- can you try updating again?
I still see the same hash in extensions.rdf though it is correct on AMO. Are AUS responses cached on the server side?
AMO responses are cached, yeah, so you'll need to twiddle a query string or wait for the cache to expire (I think it's currently an hour, but we might bring that down).
I tried it again and the update worked this time. Thanks!
I have the same problem with https://addons.mozilla.org/en-US/firefox/addon/4323 I think. It works realy well to install my "developer version" from my harddrive, or install an identical copy from http://www.roligasidor.se/0.3/roligasidor-toolbar-0.3.xpi but not the identical version at AMO. It must be this hash-file thingy? Right? This is my first extension at AMO so i realy don't know what to do to fix this problem...?

Browser: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-GB; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11

Users reporting this bug: 3!!
Pontus, your problem is bug 372302.

Mike - since there seem to be still extensions with a wrong hash, maybe recalculate it for all files? At least this bug can be closed then and if the problem reappears we can be sure that there is a bug in AMOv3.
This same bug is happening for my poster extension:

 https://addons.mozilla.org/en-US/firefox/addon/2691
Actually, this bug is also happening for my extension: (https://addons.mozilla.org/en-US/firefox/addon/1608)

The problem is definitely that Mozilla Addons is serving the incorrect hash. You'll note that Alex Milowski posted above his extension 2691, with hash code: sha1:ab0ac18555a6833271a24b100ceb98b473c91ae0.

This is also the hash code that Mozilla reports for my extension.

This is also the hash code that Wladimir Palant reported (in comment 27 of this bug) that used to be erroneous for another extension.

So, either we all hash to the same value, or there has been a corruption of the database. :p
I've recalculated the hash for both 2691 and 1608 and they work now.

I think we were planning to run the hash maintenance script - morgamic?
That's interesting. A quick Google search on this hash value brought up this: http://viewvc.svn.mozilla.org/vc/addons/trunk/site/app/tests/data/remora-test-data.sql?r1=1929&r2=1928&pathrev=1929

So this is a hash value from the test database??? How did it get into production? Or was it simply the same bug that created it in the test database? Guess now you can at least search for that value, there are probably more files with the same hash...
The hash maintenance script sounds like a good idea.  As of this morning:

mysql> select id,filename from files where hash="sha1:ab0ac18555a6833271a24b100ceb98b473c91ae0";

....

241 rows in set (0.03 sec)
Depends on: 377082
The hash script was uploaded and ran tests on preview files (from the migration) n khan-vm -- worked great.  We're going to run this tonight or tomorrow to hopefully fix all artifacts from the migration.
Status: REOPENED → ASSIGNED
We're running the update script today so any remaining artifacts from the file migration should be fixed.

Hashes and File sizes should be updated.
Status: ASSIGNED → RESOLVED
Closed: 18 years ago → 17 years ago
Resolution: --- → FIXED
I am getting this identical message consistently when attempting to install several extensions, such as:

Tab Session History 0.4
https://addons.mozilla.org/en-US/firefox/addon/7340

HistoryInTab 0.1
https://addons.mozilla.org/en-US/firefox/addon/10302

Cleared cache, restarted, etc, no change.

-- 
Terry Pinnell, East Grinstead, UK
I get this on https://preview.addons.mozilla.org

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Firefox/3.5.1

[AMO508Testday]
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: