pkg/49384: www/py-flask-user distfile checksum error (distfile changed?)

[kre%munnari.OZ.AU@localhost]

>Number:         49384
>Category:       pkg
>Synopsis:       www/py-flask-user distfile checksum error (distfile changed?)
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 11 22:25:00 +0000 2014
>Originator:     Robert Elz
>Release:        NetBSD 6.99.17  (immaterial)  -- pkgsrc current 2014-11-11
>Organization:
	Prince of Songkla University
>Environment:
System: NetBSD perseus.noi.kre.to 6.99.17 NetBSD 6.99.17 (GENERIC) #1: Fri Feb 22 22:09:50 ICT 2013 kre%jade.coe.psu.ac.th@localhost:/usr/obj/current/i386/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
	The distfile expected by the (recently updated) www/py-flask-user
	is not the same distfile that is available on the MASTER_SITE

>How-To-Repeat:
	save a copy of distfiles/lask-User-0.6.1.tar.gz (and remove that one)

	cd ..../pkgsrc/www/py-flask-user
	make checksum

	The file downloaded will be 42257 bytes, the distinfo file
	expects 42288 - needless to say the checksums do not match.
>Fix:
	Figure out what changed - someone who has the original distfile
	will need to do that.  It appears to have altered at the master
	site a short while after the pkgsrc update was committed.

	Because of that, if the change is benign, it will need a
	DIST_SUBDIR (some users may have downloaded the older distfile
	before it was altered) - and perhaps a revbump (depending upon
	just what changed).

	If the change looks to be some kind of malware, get the master
	site to recreate the correct distfile, and protect themselves
	from intrusions (this is the less likely case, naturally).