>Number:         25250
>Category:       pkg
>Synopsis:       cksum mismatch for x11/xfce4-gtk2-engines
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Apr 20 01:18:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     George Peter Staplin
>Release:        2.0-beta (releng april 13 snapshot)
>Organization:
>Environment:
NetBSD magichimo 2.0_BETA NetBSD 2.0_BETA (GENERIC) #0: Sat Apr 17 07:29:06 UTC 2004  autobuild@tgm.netbsd.org:/autobuild/netbsd-2-0/i386/OBJ/autobuild/netbsd-2-0/src/sys/arch/i386/compile/GENERIC i386

>Description:
The tarball cksum needed by the package doesn't match, even after a make distclean and remake.

Strangely the tarballs of 2.1.9 at the following locations seem to have the same mistmatched md5 sum: 
 http://hannelore.f1.fhtw-berlin.de/mirrors/xfce4/xfce-4.0.5/src/gtk-xfce-engine-2.1.9.tar.gz
ftp://ftp.berlios.de/pub/xfce-goodies/4.0.5/gtk-xfce-engine-2.1.9.tar.gz


>How-To-Repeat:
# make
===> *** No /usr/pkgsrc/distfiles/pkg-vulnerabilities file found,
===> *** skipping vulnerability checks. To fix, install
===> *** the pkgsrc/security/audit-packages package and run
===> *** '/usr/pkg/sbin/download-vulnerability-list'.
=> gtk-xfce-engine-2.1.9.tar.gz doesn't seem to exist on this system.
=> Attempting to fetch gtk-xfce-engine-2.1.9.tar.gz from http://www.xfce.org/archive/xfce-4.0.5/src/.
=> [347548 bytes]
Requesting http://www.xfce.org/archive/xfce-4.0.5/src/gtk-xfce-engine-2.1.9.tar.gz
ftp: Error retrieving file - `404 Not Found'
=> Attempting to fetch gtk-xfce-engine-2.1.9.tar.gz from http://hannelore.f1.fhtw-berlin.de/mirrors/xfce4/xfce-4.0.5/src/.
=> [347548 bytes]
Requesting http://hannelore.f1.fhtw-berlin.de/mirrors/xfce4/xfce-4.0.5/src/gtk-xfce-engine-2.1.9.tar.gz
100% |***********************************************|   339 KB   23.97 KB/s    00:00 ETA
347525 bytes retrieved in 00:14 (23.97 KB/s)
=> Checksum mismatch for gtk-xfce-engine-2.1.9.tar.gz.
Make sure the Makefile and checksum file (/usr/pkgsrc/x11/xfce4-gtk2-engines/distinfo)
are up to date.  If you want to override this check, type

>Fix:
Update the sum or ignore it -- if you trust that the file hasn't become corrupt or turned into a trojan.  The official XFCE SourceForge site doesn't even have 2.1.9  They only seem to have 2.1.1 at SourceForge.

Thanks for making pkgsrc so good :)
>Release-Note:
>Audit-Trail:
>Unformatted: