pkg/36262: pkgsrc "make checksum" has been nobbled

[kre%munnari.OZ.AU@localhost]

>Number:         36262
>Category:       pkg
>Synopsis:       pkgsrc "make checksum" has been nobbled
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 02 09:00:00 +0000 2007
>Originator:     Robert Elz
>Release:        NetBSD 3.99.15  (pkgsrc current within pas hour or so)
>Organization:
        Prince of Songkla University
>Environment:
System: NetBSD jade.coe.psu.ac.th 3.99.15 NetBSD 3.99.15 
(GENERIC-1.696-20060125) #8: Wed Jan 25 04:59:39 ICT 2006 
kre%jade.coe.psu.ac.th@localhost:/usr/obj/current/kernels/JADE_ASUS i386
Architecture: i386
Machine: i386
>Description:
        It was once the case that one could perform a
                make checksum
        in eevry package to verify that all of the distfiles
        are present and correct.   This no longer works
        as "make checksum" now keeps a "I was already done once"
        cookie file, and does nothing any time after the first.

        That's useless.

        For me, it is more annoying than serious, as when I perform my
        weekly checksum of everything, my /usr/obj is mounted read only
        (all I am doing is a verification, nothing is supposed to be
        changing) so the cookie files can't be created, and so,
        for me, make checksum is still working.   Of course it does
        complain, and make exits with a false status, after every
        package, so "annoying" is a polite way of indicating what I
        really believe of all of this...

>How-To-Repeat:
        By inspection.   Of, make /usr/obj read only (or set
        WRKOBJDIR to reference something that doesn't exist and
        can't easily be created), and run "make checksum" in
        any package (doesn't even need to be one that has a
        distfile to see this effect I believe).

        Expect to see something like ...


++++++++++++++++++++++++++++++++ archivers/9e ...
=> Required installed package digest>=20010302: digest-20050731 found
=> Checksum SHA1 OK for 9e.tar.gz
mkdir: /usr/obj/pkg/archivers: Read-only file system
cannot create /usr/obj/pkg/archivers/9e/work.jade/.checksum_done: directory none
xistent
*** Error code 2

Stop.
make: stopped in /usr/src/pkgsrc/archivers/9e

>Fix:
        My guess is that this nonsense was an attempt to fix the
        previous (mildly annoying but harmless) artifact where
        the checksum algorithms would be run twice with "make checksum"
        any time the file actually needded to be fetched (once as part
        of the fetch, to confirm that completed, and then again as
        the direct objective of make checksum).

        The way that should have been fixed was to redesign the
        fetch/checksum targets so each has a defined job to do, and
        then both the internal pgksrc needs (when fetching/verifying
        a distfile before building) and the UI "make checksum"  get
        to use targets that actually achieve the desired objective.

        Note that now, a "make install" only gets to discover that the
        distfile was correct, last year sometime, or whatever, and no
        longer has any idea whether or not the file is correct now,
        when it is needed (assuming the workdir remains of course).
        That's wrong.

        Generally, any time there is a temptation to create a cookie file
        in a makefile you should treat that as an alarm - it indicates
        that you're approaching things the wrong way.   Make's job is
        to make things, and meaningless cookie files don't count.
        Dependencies should always be on things that need making,
        no-one cares about empty dot files cluttering obj directories.