Failed to verify checksum when mirroring

[Geobert]

Hi again,

another issue we're facing with the deployed instance of Ktra is this:

Downloaded chrono v0.4.19 (registry `ssh://git@our_git_instance_address/rust/crates.io-mirror.git`)
error: failed to verify package tarball

Caused by:
  failed to download replaced source registry `https://github.com/rust-lang/crates.io-index`

Caused by:
  failed to verify the checksum of `chrono v0.4.19 (registry `ssh://git@our_git_instance_address/rust/crates.io-mirror.git`)`

The logs seems alright:

Feb 16 10:29:07.163  INFO request{method=GET
path=/ktra/api/v1/mirror/chrono/0.4.19/download version=HTTP/1.1
remote.addr=some_address:some_port}: warp::filters::trace: finished processing
with success status=200,

[moriturus]

Could you verify the checksum manually, please?

curl YOUR_HOST_OR_IP:PORT/ktra/api/v1/mirror/chrono/0.4.19/download --output chrono.crate && openssl dgst -sha256 chrono.crate

If you hit this command, you will get below message:

SHA256(download)= 670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73

[Geobert]

Thanks for your answer!

I'm getting:

SHA256(chrono.crate)= e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

but that's to be expected: the size is 0…

EDIT: the Docker container is in a Swarm and there's a proxy involved so maybe the proxy is blocking stuff, we're looking at that and I'll keep you posted :)

[Geobert]

It was a proxy setting issue, the crates downloaded were all 0 size in Ktra. We had to fix our proxy settings for the swarm and delete everything in ktra as it was still serving the 0 size crate. Maybe a size check to see if the existing file is correct? or even do the checksum verification on downloading in cache, if wrong, reject and serve an error instead?

[moriturus]

Yes, as you said it seems that there is a problem in current ktra's implementation.
I will fix it in a couple of days.