Comment 3 for bug 1098738

On Sat, Jan 12, 2013 at 02:24:09PM -0000, Marc Deslauriers wrote:
> Steps to reproduce in a newly-installed Quantal VM:
>
> 1- apt-get update
> 2- Modify /var/lib/apt/lists/*Sources file to break sha1 and sha256 sums of 'hello' package
> 3- apt-get source hello
>
> I would expect this to fail, but it doesn't.
>
> If you then modify *Sources again to break the md5 sum of the 'hello'
> package, apt-get source hello then fails as expected.
>
> In apt-get.cc, DoSource() seems to do:
>
> new pkgAcqFile(&Fetcher,Last->Index().ArchiveURI(I->Path),
> I->MD5Hash,I->Size,
> Last->Index().SourceInfo(*Last,*I),Src);

Thanks for your bugreport. Indeed, the debsrcrecords.cc parser is just
looking that the "Files" section in the source package record AFAICT
not the new Checksums-{sha1,sha256}.

For a long time the server had no sha{1,256} information in the Source
records. But now that it has there seems to be some issues here too,
e.g. the quantal partner archive has:
"""
Files:
 54ed74fd2fc267d562d35c219c5c33f5 14131200 adobe-flashplugin_11.2.202.261.orig.tar.gz
 f486992e58f025bdbd4cbeb57c7751da 5213 adobe-flashplugin_11.2.202.261-0quantal1.diff.gz
 273e471dbdc98bd28f3d2693ad41dea8 1739 adobe-flashplugin_11.2.202.261-0quantal1.dsc
Checksums-Sha1: 3daa3f68d64940489c04077c5db3123102218fdd 14131200
adobe-flashplugin_11.2.202.261.orig.tar.gz
 69b3cce479651bafe11282ee8efd86a103f90baf 5213 adobe-flashplugin_11.2.202.261-0quantal1.diff.gz
Checksums-Sha256:
c70cfd0df681b3d686c7d1a0bc3f911dd16a5f0710af9fbc3dabdb7be26851db 14131200 adobe-flashplugin_11.2.202.261.orig.tar.gz
 bc339b8e637ae0b99ac009528c1a9f7401322b9a7323d3988af9dfbdac39b944 5213 adobe-flashplugin_11.2.202.261-0quantal1.diff.gz
"""

I.e. for the .dsc file there is just a md5, not a sha available would
be good to figure out why this is the case. Interesstingly the main
archive seems to be ok.

I attached a first iteration of a fix, it needs a test and it also
needs some tweaking, see the FIXMEs. The other issue is that
technically at this form it breaks API as there is the rename MD5Hash
-> Hash. We could leave the misleading name I guess.

Cheers,
 Michael