Sudden build failures caused by SHA512SUM mismatch

[pedrolamarao]

Has anyone started seeing build failures caused by SHA512SUM mismatches today?

The following problem started happening to me just now.

Package: libsodium:[email protected]#1

Host Environment

• Host: x64-windows
• Compiler: MSVC 19.39.33523.0
• vcpkg-tool version: 2024-02-07-8a83681f921b10d86ae626fd833c253f4f8c355b
  vcpkg-scripts version: 7a7ef70 2024-02-21 (4 months ago)

To Reproduce

vcpkg install
Failure logs

-- Downloading https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz -> jedisct1-libsodium-1.0.19.tar.gz...
[DEBUG] To include the environment variables in debug output, pass --debug-env
[DEBUG] Trying to load bundleconfig from C:\prodist\dev\vault-native\vcpkg\vcpkg-bundle.json
[DEBUG] Failed to open: C:\prodist\dev\vault-native\vcpkg\vcpkg-bundle.json
[DEBUG] Bundle config: readonly=false, usegitregistry=false, embeddedsha=nullopt, deployment=Git, vsversion=nullopt
[DEBUG] Metrics enabled.
[DEBUG] Feature flag 'binarycaching' unset
[DEBUG] Feature flag 'compilertracking' unset
[DEBUG] Feature flag 'registries' unset
[DEBUG] Feature flag 'versions' unset
[DEBUG] Feature flag 'dependencygraph' unset
Downloading https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz
[DEBUG] Trying to hash C:\prodist\dev\vault-native\vcpkg\downloads\jedisct1-libsodium-1.0.19.tar.gz.14584.part
[DEBUG] C:\prodist\dev\vault-native\vcpkg\downloads\jedisct1-libsodium-1.0.19.tar.gz.14584.part has hash efeb4c0dc352993fc128974abb27e4be60521e85ce191c8c38a84168d4e7d7b1d2c26843250077dd21dadb13678bf56712375e74754eb02100b8cc418ebffb94
error: Failed to download from mirror set
error: File does not have the expected hash:
url: https://github.com/jedisct1/libsodium/archive/1.0.19.tar.gz
File: C:\prodist\dev\vault-native\vcpkg\downloads\jedisct1-libsodium-1.0.19.tar.gz.14584.part
Expected hash: 6094d7bf191ea3be85f2ddab76b71f1b9c69c786493db5b84d3c5d5a0237003377ddf6a8687a962ea651fe4a9369cf5ee1676ba0bae82690f5f7ef31a698efa9
Actual hash: efeb4c0dc352993fc128974abb27e4be60521e85ce191c8c38a84168d4e7d7b1d2c26843250077dd21dadb13678bf56712375e74754eb02100b8cc418ebffb94
[DEBUG] D:\a\_work\1\s\src\vcpkg\base\downloads.cpp(1030): 
[DEBUG] Time in subprocesses: 0us
[DEBUG] Time in parsing JSON: 6us
[DEBUG] Time in JSON reader: 0us
[DEBUG] Time in filesystem: 849us
[DEBUG] Time in loading ports: 0us
[DEBUG] Exiting after 928 ms (916578us)

CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:32 (message):
      
      Failed to download file with error: 1
      If you are using a proxy, please check your proxy setting. Possible causes are:
      
      1. You are actually using an HTTP proxy, but setting HTTPS_PROXY variable
         to `https://address:port`. This is not correct, because `https://` prefix
         claims the proxy is an HTTPS proxy, while your proxy (v2ray, shadowsocksr
         , etc..) is an HTTP proxy. Try setting `http://address:port` to both
         HTTP_PROXY and HTTPS_PROXY instead.
      
      2. If you are using Windows, vcpkg will automatically use your Windows IE Proxy Settings
         set by your proxy software. See https://github.com/microsoft/vcpkg-tool/pull/77
         The value set by your proxy might be wrong, or have same `https://` prefix issue.
      
      3. Your proxy's remote server is out of service.
      
      If you've tried directly download the link, and believe this is not a temporary
      download server failure, please submit an issue at https://github.com/Microsoft/vcpkg/issues
      to report this upstream download server failure.
      

Call Stack (most recent call first):
  scripts/cmake/vcpkg_download_distfile.cmake:270 (z_vcpkg_download_distfile_show_proxy_and_fail)
  scripts/cmake/vcpkg_from_github.cmake:106 (vcpkg_download_distfile)
  ports/libsodium/portfile.cmake:1 (vcpkg_from_github)
  scripts/ports.cmake:170 (include)

Additional context

vcpkg.json

{
  "name": "dev-prodist-master-key",
  "version": "0.15.2",
  "dependencies": [
    "abseil",
    "gtest",
    "libsodium",
    "openssl"
  ]
}

[pedrolamarao]

Topic at libsodium project: jedisct1/libsodium#1385

[dg0yt]

As pointed out in x other comments: libsodium moves somes tags like branches. The vcpkg port already switched to the tags which are used as "point releases".

[dg0yt]

And searching existing issues may help:

[pedrolamarao]

Sorry for the noise. Having a security library suddenly "mismatch" was very scary.

[dg0yt]

Noise doesn't help to sort security issue from ... noise.

I don't think that libsodium follows a good strategy with "moving tags", but they didn't allow this discussion in jedisct1/libsodium#1373 (comment).

[jedisct1]

Distribution files are here: https://download.libsodium.org/libsodium/releases/

-stable are constantly updated, point releases are never updated after a release.

Point releases are listed on GitHub here: https://github.com/jedisct1/libsodium/releases
Binary packages and tarballs are attached to every release. They are exactly the same files that the ones at https://download.libsodium.org/libsodium/releases/ and never change.

[dg0yt]

It is already covered in the vcpkg port.
Even a note was added some days ago, #39388.