人工可信存储库已损坏

Question

jfrog 可信赖的 artifactory 存储库中 Packages.bz2 文件中的校验和与软件包不匹配。这会导致镜像和安装失败。已检查 2018 年 7 月 19 日 0606 UTC

$ curl -s https://jfrog.bintray.com/artifactory- 
debs/dists/trusty/main/binary-amd64/Packages.bz2|bzcat|grep -A2 -F jfrog-artifactory-oss-6.1.0.deb
Filename: pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-6.1.0.deb
SHA1: dfe6d0cce9c3ca946d27b8dd1cf080e0ef6b9818
SHA256: c88e6f2f183426721ce3273642e0df00abce2150c7ca67afe1a69b175e9775f6

$ curl -s https://jfrog.bintray.com/artifactory-debs/pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-6.1.0.deb | sha1sum
da39a3ee5e6b4b0d3255bfef95601890afd80709  -
$ curl -s https://jfrog.bintray.com/artifactory-debs/pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-6.1.0.deb | sha256sum
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  -

编辑：

正如 Royg 所指出的那样，我错过了 -L 标志到 curl 以遵循 bintray 的重定向。但是，这会暴露 4.3.1 版本的软件包存在问题：

$ curl -sL https://jfrog.bintray.com/artifactory-debs/dists/trusty/main/binary-amd64/Packages.bz2 | bzcat | grep -A2 -F jfrog-artifactory-oss-4.3.1.deb
Filename: pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-4.3.1.deb
SHA1: dc8b12436f309b538f6b80b4027b797e3cfce897
SHA256: 8cad6699ff17866b93a02124254ba3fb9a3ca2036048161b9bd3a49c8257831f

$ curl -sL https://jfrog.bintray.com/artifactory-debs/pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-4.3.1.deb | sha1sum
575dc3debd016ff3a21e635625de266a6b0c2e48  -

Answer 1

您在 curl -L 或 --location 中缺少重定向选项。

如果您尝试使用-v 或--verbose 对工件执行curl 命令，您可以看到Bintray 将您重定向到离您最近的CDN。这意味着您在空工件上是 sha1sum 和 sha256sum，这就是校验和不匹配的原因。

$ curl https://jfrog.bintray.com/artifactory-debs/pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-6.1.0.deb -vL | sha1sum dfe6d0cce9c3ca946d27b8dd1cf080e0ef6b9818 - $ curl https://jfrog.bintray.com/artifactory-debs/pool/main/j/jfrog-artifactory-oss-deb/jfrog-artifactory-oss-6.1.0.deb -vL | sha256sum c88e6f2f183426721ce3273642e0df00abce2150c7ca67afe1a69b175e9775f6 -