robert’s rant room

Short version: RESTRICT=”mirror” for 24 hours.

Long version:

Fixing some security bugs in teTeX yesterday, I came across a problem that only happens when upstream really messes up: Changing their tarball and leave the same name.

This is disruptive as the user/portage can decide to download either from one of Gentoo’s mirrors or the SRC_URI, but he has one checksum for the file it expects. So we have two options now: Mirror the old file ourselves, changing SRC_URI to mirror://gentoo/ or update the file on our mirrors.

The latter is not a trivial thing to do though: Just changing the checksum and upload the new ebuild could cause serious damage to users. The tarball was 100 MB big and if a user has ten mirrors set up, 1 GB of traffic could be caused before downloading from SRC_URI. Solar came up with a great trick here:

1. Change all ebuilds referencing that file to RESTRICT=”mirror“.
2. Change the checksum of the distfile.
3. Wait a day.
4. Remove RESTRICT.

This will probably cause least damage (ok, it’s second to renaming the file). Users with current trees will download the new file from the SRC_URI. If they have the old file still on their disk, portage will download a new one. Users with old trees will find the file on the mirrors until some hours after (2). They have to re-sync or die a very painful traffic-death.

And that’s why you should

1. always emerge --sync before updating anything.
2. never ever re-release a file with the same name.

Don’t use them. Or review the results before clicking “Send”. (via hadess)