<div dir="ltr">On 19 September 2017 at 15:34, Carlos Alberto Lopez Perez <span dir="ltr"><<a href="mailto:clopez@igalia.com" target="_blank">clopez@igalia.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span class="gmail-">On 19/09/17 10:09, Burton, Ross wrote:<br>
> Then the tarball for one of Erlang's repositories changed, and was noticed<br>
> by the checksum in the recipe (thanks Gunnar Andersson for reporting<br>
> this). The extracted contents are identical, but the tarball itself has<br>
> changed. I'm presuming this is due to the old tarball expiring in their<br>
> cache, and a newly generated tarball using a later version of tar.<br>
<br>
</span>I don't think tar is the one to blame, but gzip.<br>
I have just tested GNU tar (versions 1.29 and 1.26) and BSD tar (from<br>
OpenBSD 5.8) and the 3 have produced identical archives (same md5sum)<br>
when invoked like git archive does.<br>
<br>
However, the .tar.gz file generated was different in the case of BSD.<br>
It even had a different file size.<br>
<br>
I bet that if you uncompress both files, the .tar will have the same<br>
checksum in both cases.<br></blockquote><div><br></div><div>In the situation that I was talking to Gunnar with, the source is the tar itself.</div><div><br></div><div><a href="https://paste.fedoraproject.org/paste/rP67aSPn1IuYbQcz2UNY3g">https://paste.fedoraproject.org/paste/rP67aSPn1IuYbQcz2UNY3g</a></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">They have identical length<br>$ wc -c new-OTP-18.2.3.tar<br>159068160 new-OTP-18.2.3.tar<br>159068160 orig-OTP-18.2.3.tar<br>...but different content<br>$ cmp new-OTP-18.2.3.tar orig-OTP-18.2.3.tar<br>$ new-OTP-18.2.3.tar orig-OTP-18.2.3.tar differ: byte 79122433, line 2004431<br></blockquote><div><br></div><div>Basically, both tar and gzip can cause problems.</div><div><br></div><div>Ross</div></div></div></div>