Perl Modules MD5SUM Failure

[alupu@…]

All 39 Perl Modules downloaded over the BLFS 6.1 book links (Chapter 12. Programming) FAIL on the md5sums as given in the file Perl_Modules.gz.md5sums.

[LFS-User@…]

One of the problems is going to be that the download URL in the stable book points to a md5sums file in the SVN directory. This will be wrong for sure.

However, I did download the stable (6.1) md5sums file and then downloaded one of the Perl Modules and the md5sum doesn't match. Not sure what happened here. It may have been because I (might have, not sure as I don't remember) initially downloaded all the Perl Modules and then before creating a md5sums file for all the .gz files, converted them into bz2 files and made a md5sums file for that, then realizing I still needed a .gz md5sums file reconverted them.

This could account for the bad md5sums.

Not sure how to fix this in the stable book, other than to download all 39 Perl Modules (some of which may not even be available any longer as they have been updated to newer versions on CPAN) and create an md5sums file and upload it to Anduin.

SVN versions of the md5sums file should be checked as well.

[alupu@…]

Thanks McMurchy,

Excerpts from the BLFS Support List subject thread (started by me, Alex, on 10/ 17/05):

<< Dan Nicholson's reply: Same thing happened to me about a month ago. Sorry I didn't report then. I installed the ones I needed downloaded from cpan.org, and they seem to work fine.

Alex to Dan: I'm not an MD5SUM fanatic but especially in this case where the files are written "by hand" (and thus theoretically easily modifiable by any old hacker) in seeing all 39 of'em fail I got a little nervous. ... I fully concur with the BLFS - and in general the common sense - philosophy that a file should be downloaded from one place and its signature should be provided by an independent source. A file may seem to work for a while, but who knows what happens in the long run. >>

(1) Not sure how to fix this in the stable book, other than (2) download all 39 Perl Modules (3) (some of which may not even be available any longer as

they have been updated to newer versions on CPAN) and

(4) create an md5sums file and upload it to Anduin.

(1) Agree. Too late. The barn door has long been opened. (2) Agree. Downloading is not too onerous: approx. 4 SBU's in all. (3) Agree. On 10/16/05 when I did the 38-file book download I had to do the 39th (Finance-Quote) directly from CPAN. (4) Full agreement here too, Anduin is the only practical solution. The only problem - and yes, this one might be time consuming/annoying, etc. - is the need to verify at least "visually", that the files are not so changed (accidentally or maliciously) as to affect BLFS installation of various packages which require (or option) them.

-- Alex

[Randy McMurchy]

In order to fix this bug, which was reported against version 6.1 of BLFS, we need to do the following:

Download all the Perl Modules referenced in BLFS-6.1 and create a single MD5sum file of all of them and install it in the location specified here: ​http://www.linuxfromscratch.org/blfs/view/stable/general/perl-modules.html

The bug should be marked WONTFIX, and there should be some sort of errata page for BLFS-6.1 that mentions about this if the above cannot be accomplished.

BLFS-SVN has been fixed by removing any reference to MD5sums. Though it is a bad fix, it is the only thing that can be done unless Justin will download all the Perl Modules in BLFS-SVN and create an MD5sum of these files and install it on the master download server.

Justin, the bug has been assigned to you. If you cannot (or won't) create the necessary MD5sum file, please make an entry in the bug and reassign it to blfs-book@… and someone will then have to create errata about this.

[Justin R. Knierim]

Randy, thanks for assigning it. It is on my TODO list but haven't gotten around to it. I will work on it tomorrow. :)

[Justin R. Knierim]

Ok, please review the following and see if this is acceptable. The beauty of the new layout and lots of symlinks, I have added a new directory for perl-modules. I wanted to do this earlier...got put on back burner, etc. Hopefully this is ok:

​http://ftp.lfs-matrix.net/pub/blfs/svn/perl-modules/

The other mirrors will sync soon. Inside this directory are tarballs of all modules, as well as a md5sums for the bzip2'ed files and for the original files as linked from blfs.

​http://ftp.lfs-matrix.net/pub/blfs/svn/perl-modules/perl-modules.tar ​http://ftp.lfs-matrix.net/pub/blfs/svn/perl-modules/perl-modules.tar.md5sums ​http://ftp.lfs-matrix.net/pub/blfs/svn/perl-modules/perl-modules.orig.md5sums

So the BLFS book can referencce the perl-modules.orig.md5sums and that should suffice.

[Randy McMurchy]

Justin, you are the man!

Thanks for the start. I will check the versions of the Modules against what is in BLFS-stable and BLFS-SVN. The module versions are different, so I'll have to see which is which. However, you have a good handle on what we need, and how we'll get there.

More to follow.

[Justin R. Knierim]

Update to the last comment by me:

As a result of the BLFS svn repo changing from all bz2 to original package format, now there is no need to name the file "perl-modules.orig.md5sums". The file is now simply "perl-modules.md5sums". It is available here still:

​ftp://ftp.lfs-matrix.net/pub/blfs/svn/perl-modules/perl-modules.md5sums

And the tarball of all the original-format packages are also available:

​ftp://ftp.lfs-matrix.net/pub/blfs/svn/perl-modules/perl-modules.tar.bz2

Of course, substitute your favorite mirror.

Re-assigning back to blfs-book as my part is finished and I don't know who will update the book.

[Randy McMurchy]

Readded the links to the md5sums in the SVN Perl Modules instructions. SVN is now fixed, but the 6.1 book still has the issues. To fix the 6.1 book, we either:

1) Create an errata page where it mentions the md5sum files are

not available

2) Create a

​http://anduin.linuxfromscratch.org/sources/BLFS/SVN/Perl_Modules/Perl_Modules.gz.md5sums file populated with the 6.1 versions of the tarballs. Not sure if it worth the trouble. It is up to Justin to determine if he wants to do it or not.

I'm leaving the bug open until a decision is made on what to do for the 6.1 book.

[dnicholson@…]

I say it's not worth it to track down the md5sum of the 6.1 tarballs. Make an errata page and mention there is none. I still think it's worth it to create an errata page even if we don't go back and track down all the issues.

[Randy McMurchy]

The errata page has been created. All that now has to happen is a mention on it that the MD5sums for the BLFS-6.1 book (Perl Modules) are wrong.

[bdubbs@…]

Fixed at website revision 760. The pages should update tonight.