[libmagic] build failure

[as-ascii]

Operating system

x64-windows

Compiler

MSVC

Steps to reproduce the behavior

vcpkg install libmagic

Failure logs

Installing 92/120 libmagic:[email protected]...
Building libmagic:[email protected]...
Downloading https://github.com/file/file/archive/FILE5_46.tar.gz -> file-file-FILE5_46.tar.gz
D:\a\docwire\docwire\vcpkg\downloads\file-file-FILE5_46.tar.gz.740.part: error: download from https://github.com/file/file/archive/FILE5_46.tar.gz had an unexpected hash
note: Expected: 9165bb5bdbe7b8fccac0c8675d4eb251a286ab2ab7a79e6f8ed98d36fa0928b889cf109c1da3a5cfff64d1b1006b5d73934c2d420484adae6f4c8e26a9ede18f
note: Actual : fb8157ee8065feaf57412ccdeee57cd8fc853b54ac49b0ddc818eeb1ca3555a7cfd25dea08996503f7c565dcba8c57fd7e4dc5fe3452872c617f5612a94a8f0e
CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:124 (message):
Download failed, halting portfile.
Call Stack (most recent call first):
scripts/cmake/vcpkg_from_github.cmake:106 (vcpkg_download_distfile)
ports/libmagic/portfile.cmake:21 (vcpkg_from_github)
scripts/ports.cmake:196 (include)

See also: https://github.com/docwire/docwire/actions/runs/13065608685/job/36491110203

Additional context

No response

[as-ascii]

The URL is working, file looks like a correct archive but hash is incorrect, File was probably replaced by upstream but better to be safe and double check.

[rjzak]

I'm also having this issue. PR: #42939, commit hash ddcee8f.

[as-ascii]

The github project that is used by VCPKG to download libmagic source code is https://github.com/file/file. There is a homepage https://www.darwinsys.com/file/ mentioned there. The official FTP repository mentioned on that homepage is ftp://ftp.astron.com/pub/file/ but when I downloaded the file from there it has a third, different sha512 checksum:

sha512sum file-5.46.tar.gz 
a6cb7325c49fd4af159b7555bdd38149e48a5097207acbe5e36deb5b7493ad6ea94d703da6e0edece5bb32959581741f4213707e5cb0528cd46d75a97a5242dc  file-5.46.tar.gz

So there is no clear for me what is correct and what is not and how to fix this issue.
Could a maintainer of this port look at this issue please?

I hope it is not some backdoor issue like with XZ packages recently, better to be careful.

[as-ascii]

@FrankXie05 Could you please take a look? I can see that the latest commit in libmagic port directory is yours.

[FrankXie05]

Could a maintainer of this port look at this issue please?

I hope it is not some backdoor issue like with XZ packages recently, better to be careful.

This port is hosted on github, and vcpkg will also download the source code directly from github.

vcpkg/scripts/cmake/vcpkg_from_github.cmake

Line 107 in 3de032f

URLS "${github_host}/${org_name}/${repo_name}/archive/${ref_to_use}.tar.gz"

[FrankXie05]

For hash changes, since the source code download here depends on REF rather than the specific commit hash, it may cause the Tarball generated by github to be different.

[as-ascii]

Maybe it would be better to download files from official website instead of github mirror? The description on github project site clearly states that its automatic mirror. I don't know how this mirror is created but maybe some forced pushes are done etc. Unfortunately the official site supports only FTP downloads I can see. I don't know much about VCPKG official strategy for this kind od issues.

[as-ascii]

Thanks for the fix!

[FrankXie05]

@as-ascii Next time update we will use commit hash to avoid this issue.

[as-ascii]

Just to let you know for the history record: we now have a situation that vcpkg port with the same version number but different port number compiles library that unfortunately WORKS DIFFERENTLY that previous one (for zip files and it seems to have some regressions in this area). Of course the problem is probably on the upstream side but good to know what kind of situations we can have here and introduce solutions that will help to avoid them.

[BillyONeal]

vcpkg is an index of what upstream says. If upstream changes the behavior without bumping the version number, we already provide mechanisms for you to detect and avoid it: the baseline and asset caching systems.