762152 - MD5 and SHA1 Hashes Invalid on FTP Mirrors for Thunderbird 13.0

Status: RESOLVED FIXED

(Release Engineering :: Release Requests, defect)

Description

[David E. Ross]

Using an FTP client, I downloaded Thunderbird Setup 13.0.exe from the FTP server at releases.mozilla.org in the path </pub/mozilla.org/thunderbird/releases/13.0/win32/en-US>.  I also downloaded the associated SHA1SUMS and MD5SUMS files.  The SHA1 and MD5 hashes for win32/en-US/Thunderbird Setup 13.0.exe do not validate against Thunderbird Setup 13.0.exe.  

I reported this in the mozilla.support.thunderbird and saw a reply 3 hours later that this would be fixed "later today" ("today" being the next day per the time-zone indicator).  It is now more than 14 hours since I reported this.  I will not upgrade Thunderbird until I have a hash that indicates my download was not corrupted.

Comment 1

[Rail Aliiev [:rail]]

It looks like we forgot to regenerate checksums for the win32 binaries after we repacked the initial ones. I fixed the checksums and synced them into /releases/13.0 directory. The files should be available on the mirrors within 24 hours.

https://wiki.mozilla.org/Releases/Thunderbird_13.0/BuildNotes#Checksums

Comment 2

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

Argh. Good catch David. 

1) I can reproduce this. The md5 for win32/en-US/Thunderbird Setup 13.0.exe is fae0a5584cc2f7f2541408f17caf6074, but ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/13.0/MD5SUMS claims the md5 should be 36d3d9585c737ef6a614a1f48295c364. I suspect this is a problem with win32 only. We had to rebuild win32-only in a rush yesterday because of a late breaking issue, (details in bug#744598), and my guess is that the win32 md5 were not refreshed at same time.

2) I've now spot-tested and verified this is not a problem with mac and linux. So far each .dmg and .bz2 that I've checked has md5 that matches the listed md5 in ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/13.0/MD5SUMS.

This confirms my opinion that we forgot to refresh the md5 list after the rush rebuild. We'll also recheck the .asc files for win32 while we're at it.

Comment 3

[Rail Aliiev [:rail]]

I checked the new generated checksums files and they look fine now. Need some time to distribute the files across the mirrors.

Comment 5

[remarf.eoj]

According to http://releases.mozilla.org/pub/mozilla.org/thunderbird/releases/13.0/SHA1SUMS the SHA1SUM for win32/en-US/Thunderbird Setup 13.0.exe should be 7820bcbef5383aea6f77a54500b6eec1cb06cd6b. However the actual SHA1SUM for that file is 0db724f0993e933e842ece71631dcf5bcdff51d4.

According to http://releases.mozilla.org/pub/mozilla.org/thunderbird/releases/13.0/MD5SUMS the MD5SUM for win32/en-US/Thunderbird Setup 13.0.exe should be 36d3d9585c737ef6a614a1f48295c364. However the actual MD5SUM for that file is 7448aa92d9c8ee13cbe5708e6f0033a6.

According to http://releases.mozilla.org/pub/mozilla.org/thunderbird/releases/13.0/SHA512SUMS the SHA512SUM for win32/en-US/Thunderbird Setup 13.0.exe should be 02aae308e611a3d9f8afae517f5cb9f5bb1494ef847a0fb92a2af17756fd3893ca624d7f1101b532c9af504c566bfd68c511f32fbd78241072d102fe548e3599. However the actual MD5SUM for that file is 4d3040abd742229ecb43ebc0abab96edfda06fba3c3f913a208ebe91319fa78afcfe7c47409fc6bce180a6792875e6acd0b6ede2e707240839b96cf3d91402e6.

This has been re-confirmed at 07-06-2012 15:45 (in a dd-mm-yyyy hh:mm format).

This is also the reason I filed bug 762468 in the first place, since this issue is currently not fixed.

Comment 6

[Rail Aliiev [:rail]]

Hmmmm, I synced the files yesterday and double checked them. Redoing the same operation again and leaving the bug open to check the status later.

[[e-mail]3 13.0]$ for f in /pub/mozilla.org/thunderbird/releases/13.0/*SUMS; do cmp $f /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/$(basename $f); done/pub/mozilla.org/thunderbird/releases/13.0/MD5SUMS /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/MD5SUMS differ: byte 93323, line 1172
/pub/mozilla.org/thunderbird/releases/13.0/SHA1SUMS /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/SHA1SUMS differ: byte 102691, line 1172
/pub/mozilla.org/thunderbird/releases/13.0/SHA512SUMS /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/SHA512SUMS differ: byte 205739, line 1172


[[e-mail]3 13.0]$ rsync -avn /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/*SUMS* /pub/mozilla.org/thunderbird/releases/13.0/
sending incremental file list
MD5SUMS
MD5SUMS.asc
SHA1SUMS
SHA1SUMS.asc
SHA512SUMS
SHA512SUMS.asc

sent 150 bytes  received 30 bytes  360.00 bytes/sec
total size is 566509  speedup is 3147.27 (DRY RUN)
[[e-mail]3 13.0]$ rsync -av /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/*SUMS* /pub/mozilla.org/thunderbird/releases/13.0/
sending incremental file list
MD5SUMS
MD5SUMS.asc
SHA1SUMS
SHA1SUMS.asc
SHA512SUMS
SHA512SUMS.asc

sent 566959 bytes  received 126 bytes  1134170.00 bytes/sec
total size is 566509  speedup is 1.00
[[e-mail]3 13.0]$ for f in /pub/mozilla.org/thunderbird/releases/13.0/*SUMS; do cmp $f /pub/mozilla.org/thunderbird/candidates/13.0-candidates/build1/$(basename $f); done

Comment 7

[remarf.eoj]

At 08-06-2012 08:28 (in a dd-mm-yyyy hh:mm format) this appears to be fixed. The checksums check out atleast.

Comment 8

[David E. Ross]

Yes.  I was able to verify the download of Thunderbird 13.0 for Windows against its SHA1 hash.