checksum error in vagrant box download of generic/freebsd13

[iameru]

checksum error in vagrant box download of generic/freebsd13

[ladar]

@TAMERU THANK YOU for letting me know. This does happen on occasion. I was the person who pushed hard to get HashiCorp to add support for the embedded hash, precisely because of the corruption.
I was hoping it would be a stopgap on the way to adding support for cryptographic signatures but I digress.

The problem can occur during download, in which case redownlading fixes it. Occasionally the uploads also get corrupted, which is what happened here. The root of the issue is that Vagrant cloud doesn't confirm whether the uploaded file matches the hash. Which is what happened here.

I've always had issues uploading releases to the Vagrant cloud, which is why I throttle the process, which reduced the error rate, but meant it the process takes signifcantly longer. I have to use ./robox.sh public afterwards to find any uploads that failed, and then upload them manually which is a huge pain.

Anyways, I've noticed mroe problems uploading as of late. In some cases it was uploaded errors, in others it was a delay of 4-5 hours between the upload, and the file being available for download. Which is why I overhauled the script I use for uploading (the direct.sh script), when I added arch support/and modified it to use the v2 API. That process started with 4.3.4 rekeasem wgucg is probably why that box got muned. I overhauled it again with teh 4.3.6 release, because I ran into a 30% failure rate. Hopefully it gets better. But let me know if you run into more box corruption issues.

I used to download all the files after an upload to confirm they were good, but that hasn't been possible for a long time, because of the daily use limits in place. But I did check the box you mentioned, and it looks good now, so I'm closing this issue.

[robox]# res/scripts/match.sh generic freebsd13 libvirt amd64 4.3.4
Box  +  generic freebsd13 libvirt amd64 4.3.4

[iameru]

Thanks for your effort in improving the supply chain here. I would expect hashicorp to check for corruption, if a checksum is offered and wish for signing aswell, but as you say yourself, this is not the topic here. Thanks for your effort! If you say it is fixed it probably is, will get around trying it earliest in 2 days.
thank you