Re: [ANNOUNCE] QEMU 8.2.3 Stable released

[Michael Roth]

On Sat, May 04, 2024 at 08:56:34AM +0300, Michael Tokarev wrote:
> 03.05.2024 21:42, Cal Peake wrote:
> > On Fri, 3 May 2024, Michael Tokarev wrote:
> > 
> > > The current signature files (which was updated together with the tarballs)
> > > verifies fine for me.  Did you maybe forgot to re-download the signature
> > > file?  The correct signature which is currently in the qemu download area
> > > is made Wed Apr 24 17:27:27 2024 UTC.
> > 
> > After doing a bit of digging, I see where the problem is now.
> > 
> > The new xz tarball is actually still the original one. The tarball at [1]
> > is the same as [2]. They have different timestamps, but are bit-for-bit
> > the same.
> 
> The initial issue you wrote about is that one of them does not verify.
> But if the two files are the same, they both should verify exactly the
> same way too (file timestamp isn't covered by the signature).
> 
> So it looks like there are actually two files there, which differ not
> only in timestamp but also in contents.
> 
> Another issue here is that I've seen the .xz file has changed on the
> site and noticed it has different size too, so I re-downloaded it
> and the signature, and made debian package out of it.  Now I see
> that the file I downloaded also has this directory in question
> (subprojects/dtc/).
> 
> Might it be a CDN issue?  Peter, do you know how download.qemu.org
> works behind the scenes?

FWIW we've had issues in the past where even the file listing to up to a
month to start listing new tarballs even though they were already
present on the server, which also seemed to be the result of very
aggressive CDN caching. So that's likely what happened here too, and
going by that it may similarly be another week or 2 before it corrects
itself.

> 
> Michael, it looks like we should just roll another 8.2.x stable release
> at this point (besides fixing the tarballs).  There's another issue with
> 8.2.3 - it doesn't build on riscv64 (the issue is mentioned in the 8.2
> "planning" page in "known issues" section).  There are 14 new patches in
> staging-8.2 already (with 3 riscv64 build fixes at the top).  What do
> you think?

For now I've renamed the files to 8.2.3-reupload.tar.* and updated
qemu-web.git to reflect that naming:

  
https://gitlab.com/qemu-project/qemu-web/-/commit/f5f7c272f0385cd0575631b7da8e8a637cc3d927

It might be a good idea to get a new release out if one is already in
the pipeline, if only just to reduce any disruption from the
inconsistent file naming. So if you have plans for that we can do that
as well.

Thanks,

Mike

> 
> Thanks,
> 
> /mjt
> 
> > The bz2 tarball however at [4] is the original one, while [3] is the
> > replacement without the 'subprojects/dtc' folder.
> > 
> > Michael, are you able to get this fixed up?
> > 
> > [1] https://download.qemu.org/qemu-8.2.3.tar.xz
> > 
> > [2] https://download.qemu.org/old/qemu-8.2.3.tar.xz
> > 
> > [3] https://download.qemu.org/qemu-8.2.3.tar.bz2
> > 
> > [4] https://download.qemu.org/old/qemu-8.2.3.tar.bz2
> 
>