[oe] what to do with wrong checksum

[Frans Meulenbroeks]

2009/11/7 Otavio Salvador <otavio at ossystems.com.br>:
> Hello,
>
> On Sat, Nov 7, 2009 at 12:42 PM, Koen Kooi <k.kooi at student.utwente.nl> wrote:
>> On 07-11-09 14:23, Mike Westerhof wrote:
>>>
>>> Frans Meulenbroeks wrote:
>>> ...
>>>>
>>>> Reluctantly updated checksums.ini
>>>>
>>>> Frans
>>>
>>> But of course there's no magic that will remove the old cached tarball
>>> out of one's downloads directory when this sort of thing happens.
>>> (Busybox has been known to do this, too)
>>>
>>> What do folks think we should do about that when it occurs?
>>> a) support two entries (old and new) in checksums.ini
>>> b) do nothing (leave as is)
>>> c) add some sort of support so that the user gets additional information
>>>    with the new checksum match failure explaining that the checksum was
>>>    updated and they need to manually remove the old (bad) tarball
>>
>> d) rename the tarball slighty and mirror in on a known good server (e.g.
>> angstrom sourcemirror) and have OE use that.
>
> IMO (d) is the safest and the right thing to do; this avoids more core
> to be written and avoids also we use changed versions without
> noticing.

Ok, I'll leave it to someone with better access so e.g. the
sourcemirror to change things.
BTW I've exchanged an email with the author of twig. He stated that
the version on CPAN (3.22) is the official version and that the
version we use is the current development version and subject to
change.
He proposed to move the 3.33 version to CPAN (which I encouraged).
Guess we should then move to the cpan version which is the fixed one.

Frans

PS: and I did not think of cached versions of the files, otherwise I
would probably taken somewhat more caution before upgrading
checksums.ini