Re: [ANNOUNCE] QEMU 8.2.3 Stable released

[Stefan Hajnoczi]

On Sat, May 04, 2024 at 02:43:53PM +0100, Peter Maydell wrote:
> On Sat, 4 May 2024 at 06:56, Michael Tokarev <mjt@tls.msk.ru> wrote:
> >
> > 03.05.2024 21:42, Cal Peake wrote:
> > > On Fri, 3 May 2024, Michael Tokarev wrote:
> > >
> > >> The current signature files (which was updated together with the 
> > >> tarballs)
> > >> verifies fine for me.  Did you maybe forgot to re-download the signature
> > >> file?  The correct signature which is currently in the qemu download area
> > >> is made Wed Apr 24 17:27:27 2024 UTC.
> > >
> > > After doing a bit of digging, I see where the problem is now.
> > >
> > > The new xz tarball is actually still the original one. The tarball at [1]
> > > is the same as [2]. They have different timestamps, but are bit-for-bit
> > > the same.
> >
> > The initial issue you wrote about is that one of them does not verify.
> > But if the two files are the same, they both should verify exactly the
> > same way too (file timestamp isn't covered by the signature).
> >
> > So it looks like there are actually two files there, which differ not
> > only in timestamp but also in contents.
> >
> > Another issue here is that I've seen the .xz file has changed on the
> > site and noticed it has different size too, so I re-downloaded it
> > and the signature, and made debian package out of it.  Now I see
> > that the file I downloaded also has this directory in question
> > (subprojects/dtc/).
> >
> > Might it be a CDN issue?  Peter, do you know how download.qemu.org
> > works behind the scenes?
> 
> No, I don't know. Stefan I think does?

Paolo knows about the CDN :).

> > Michael, it looks like we should just roll another 8.2.x stable release
> > at this point (besides fixing the tarballs).  There's another issue with
> > 8.2.3 - it doesn't build on riscv64 (the issue is mentioned in the 8.2
> > "planning" page in "known issues" section).  There are 14 new patches in
> > staging-8.2 already (with 3 riscv64 build fixes at the top).  What do
> > you think?
> >
> > Thanks,
> >
> > /mjt
> >
> > > The bz2 tarball however at [4] is the original one, while [3] is the
> > > replacement without the 'subprojects/dtc' folder.
> > >
> > > Michael, are you able to get this fixed up?
> > >
> > > [1] https://download.qemu.org/qemu-8.2.3.tar.xz
> > >
> > > [2] https://download.qemu.org/old/qemu-8.2.3.tar.xz
> > >
> > > [3] https://download.qemu.org/qemu-8.2.3.tar.bz2
> > >
> > > [4] https://download.qemu.org/old/qemu-8.2.3.tar.bz2
> 
> thanks
> -- PMM
>

signature.asc
Description: PGP signature