Repository: spack/spack

Issue:
Installation issue: r-boot
<!-- Thanks for taking the time to report this build failure. To proceed with the report please:

1. Title the issue "Installation issue: <name-of-the-package>".
2. Provide the information required below.

We encourage you to try, as much as possible, to reduce your problem to the minimal example that still reproduces the issue. That would help us a lot in fixing it quickly and effectively! -->

### Steps to reproduce the issue

<!-- Fill in the exact spec you are trying to build and the relevant part of the error message -->
```console
$ spack install r-boot%fj
==> Error: ChecksumError: sha256 checksum failed for /home/users/ea01/ea0114/spack-stage/spack-stage-r-boot-1.3-23-mm6cmoaof62r5y527kz24snjifgwpir6/boot_1.3-23.tar.gz
    Expected 30c89e19dd6490b943233e87dfe422bfef92cfbb7a7dfb5c17dfd9b2d63fa02f but got 79236a5a770dc8bf5ce25d9aa303c5dc0574d94aa043fd00b8b4c8ccc877357f
```

Build of `r-boot%fj` on 2020 Aug has a checksum error.
This version added to spack at 31 Aug 2019. Please see https://github.com/spack/spack/commit/661a894c85f451a4ef868abcc9871653914361bd
According to our log, same build succeeded on 2019 Oct. 

https://cloud.r-project.org/src/contrib/boot_1.3-23.tar.gz seems to be changed between these attempts.
We found old(30c89e19) boot_1.3-23.tar.gz from http://in.archive.ubuntu.com/pool/universe/b/boot/boot_1.3-23.orig.tar.gz
and compared with new(79236a5a) one.
Difference was tribial. ("Date/Publication" in boot/DESCRIPTION, and MD5 of the file in boot/MD5)
So I would like to update checksum value.

We have another question.
In this case, we found "old" archive and proof the differnce is trivial.
If we found checksum mismatch and could not find "old" archive to verify, 
which is better in view of security?
1. create issue and discuss
2. directly make PR

<!-- Some packages have maintainers who have volunteered to debug build failures. Run `spack maintainers <name-of-the-package>` and @mention them here if they exist. -->

### General information

<!-- These boxes can be checked by replacing [ ] with [x] or by clicking them after submitting the issue. -->
- [ ] I have run `spack debug report` and reported the version of Spack/Python/Platform
- [ ] I have run `spack maintainers <name-of-the-package>` and @mentioned any maintainers
- [ ] I have uploaded the build log and environment files
- [x] I have searched the issues of this repo and believe this is not a duplicate



Discussion:
Thanks for digging into this! Checksum changes are tricky security issues, but luckily you were able to find a cache of the old checksum and confirm that the changes were trivial. In this case, it's fine to open a PR to change the checksum.
Thank you for response. 
We were lucky in this case, but what should we do if we are not lucky?
(we found checksum mismatch and could not find "old" archive to verify)
Which is better in view of security?

1. Create issue and discuss
2. Open a PR
I usually just open a PR. If we can't find an old archive to verify, I contact the developers and ask them if they know why the checksum might have changed. As long as they don't say "oh, it looks like we got hacked, don't download that file" then it's usually fine.

@tgamblin and @citibeth have talked a lot about the security angle in the past. In the future, we would like to have some automated system that downloads these tarballs and checks for known security flaws.

Resolving patch:
diff --git a/var/spack/repos/builtin/packages/r-boot/package.py b/var/spack/repos/builtin/packages/r-boot/package.py
--- a/var/spack/repos/builtin/packages/r-boot/package.py
+++ b/var/spack/repos/builtin/packages/r-boot/package.py
@@ -15,7 +15,7 @@ class RBoot(RPackage):
     url      = "https://cloud.r-project.org/src/contrib/boot_1.3-18.tar.gz"
     list_url = "https://cloud.r-project.org/src/contrib/Archive/boot"
 
-    version('1.3-23', sha256='30c89e19dd6490b943233e87dfe422bfef92cfbb7a7dfb5c17dfd9b2d63fa02f')
+    version('1.3-23', sha256='79236a5a770dc8bf5ce25d9aa303c5dc0574d94aa043fd00b8b4c8ccc877357f')
     version('1.3-22', sha256='cf1f0cb1e0a7a36dcb6ae038f5d0211a0e7a009c149bc9d21acb9c58c38b4dfc')
     version('1.3-20', sha256='adcb90b72409705e3f9c69ea6c15673dcb649b464fed06723fe0930beac5212a')
     version('1.3-18', sha256='12fd237f810a69cc8d0a51a67c57eaf9506bf0341c764f8ab7c1feb73722235e')


Test patch: