pkg/55277: textproc/icu The International Components for Unicode

[joaopaulo1511%hotmail.com@localhost]

>Number:         55277
>Category:       pkg
>Synopsis:       textproc/icu The International Components for Unicode
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 19 04:25:00 +0000 2020
>Originator:     João Paulo Vinha Bittar
>Release:        pkgsrc 2020Q1
>Organization:
home user
>Environment:
NetBSD 9.0 (GENERIC) #0: Fri Feb 14 00:06:28 UTC 2020 mkrepro@mkrepro%NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
Pkgsrc 2020Q1 introduced this problem which did not exist on pkgsrc 2019Q4:

Checksum SHA1 mismatch for icu4c-64_2-src.tgz.
>How-To-Repeat:
Just build any package that depends on textproc/icu or build textproc/icu directly: "[b]make -C /usr/pkgsrc/textproc".  Then when fetching icu4c-64_2-src.tgz it will show these error messages:

checksum: Checksum SHA1 mismatch for icu4c-64_2-src.tgz
ERROR: Make sure the Makefile and checksum file (/usr/pkgsrc/textproc/icu/distinfo)
ERROR: are up to date.  If you want to override this check, type
ERROR: "/home/user/pkg/bin/bmake NO_CHECKSUM=yes [other args]".
>Fix:
One workaround is building with "NO_CHECKSUM=yes" as an argument, but it will make the system vulnerable to a man-in-the-middle attack while building the package.

The correct way to fix it is editing textproc/icu/distinfo on the pkgsrc tree to have the correct hashes for icu4c-64_2-src.tgz, as this file will be protected by the checksum files at https://ftp.netbsd.org/pub/pkgsrc/stable/*.SHA1.