Re: [ANNOUNCE] QEMU 8.2.3 Stable released

[Michael Tokarev]

03.05.2024 21:42, Cal Peake wrote:
> On Fri, 3 May 2024, Michael Tokarev wrote:
>
> > The current signature files (which was updated together with the tarballs)
> > verifies fine for me.  Did you maybe forgot to re-download the signature
> > file?  The correct signature which is currently in the qemu download area
> > is made Wed Apr 24 17:27:27 2024 UTC.
>
> After doing a bit of digging, I see where the problem is now.
>
> The new xz tarball is actually still the original one. The tarball at [1]
> is the same as [2]. They have different timestamps, but are bit-for-bit
> the same.

The initial issue you wrote about is that one of them does not verify.
But if the two files are the same, they both should verify exactly the
same way too (file timestamp isn't covered by the signature).

So it looks like there are actually two files there, which differ not
only in timestamp but also in contents.

Another issue here is that I've seen the .xz file has changed on the
site and noticed it has different size too, so I re-downloaded it
and the signature, and made debian package out of it.  Now I see
that the file I downloaded also has this directory in question
(subprojects/dtc/).

Might it be a CDN issue?  Peter, do you know how download.qemu.org
works behind the scenes?

Michael, it looks like we should just roll another 8.2.x stable release
at this point (besides fixing the tarballs).  There's another issue with
8.2.3 - it doesn't build on riscv64 (the issue is mentioned in the 8.2
"planning" page in "known issues" section).  There are 14 new patches in
staging-8.2 already (with 3 riscv64 build fixes at the top).  What do
you think?

Thanks,

/mjt

> The bz2 tarball however at [4] is the original one, while [3] is the
> replacement without the 'subprojects/dtc' folder.
>
> Michael, are you able to get this fixed up?
>
> [1] https://download.qemu.org/qemu-8.2.3.tar.xz
>
> [2] https://download.qemu.org/old/qemu-8.2.3.tar.xz
>
> [3] https://download.qemu.org/qemu-8.2.3.tar.bz2
>
> [4] https://download.qemu.org/old/qemu-8.2.3.tar.bz2