Re: [gentoo-user] getting digest verification failed when emerging bittorrent

[AllenJB]

Neil Bothwick wrote:
> On Sat, 07 Mar 2009 15:54:22 -0600, Dale wrote:
>
>>> wait 24 hours, resync, try again.
>>>
>>> Or just re-digest the package manually:
>>>
>>> ebuild <path_to_ebuild_file> manifest
>
> Bear in mind this overrides the security that digests provide, although
> it is harmless when it is only a Chnagleog file.
>
>> Does emerge --digest still exist?  I recall using something like that a
>> long time ago.  I think I used it for googleforearth which never
>> matches.
>
> That's not a good idea as the mismatch could be caused by a hacked
> source or binary file. The problem with Google Earth was that they used
> unversioned tarballs. Whenever you gt a digest error on a distfile, the
> first step is to delete the distfile and let emerge download it again. If
> that doesn't help, resync and then check Bugzilla. Don't redigest a
> distfile unless you can e 100% certain of its validity.
>
>

It's not just security. It's a basic measure to ensure the source files 
haven't changed (some projects are known to change the source files 
without changing the tarball name) and that the installation 
instructions in the ebuild are still valid.

Note that it's possible for the source files to change and the 
instructions in the ebuild appear to work, but to not correctly install 
the package.

AllenJB