{"thread":{"id":"46694","subject":"HP-UX (git-2.14.0) Depot File / Source Code Build throws SHA1 Error","startedAt":"2017-09-01T14:04:46Z","lastAt":"2017-09-05T02:20:24Z","messageCount":4,"participants":["josephpattara .","Jeff King","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"327502","messageId":"CAC-YKd1sTQLMUZ6k+-4K09=NOa_HaOf1gp8H51VNZjziUrxOfA@mail.gmail.com","threadId":"46694","inReplyTo":null,"subject":"HP-UX (git-2.14.0) Depot File / Source Code Build throws SHA1 Error","fromName":"josephpattara .","fromEmail":"josephpattara@gmail.com","sentAt":"2017-09-01T14:04:36Z","receivedAt":"2017-09-01T14:04:46Z","isPatch":false,"sender":{"key":"josephpattara@gmail.com","avatar":null},"body":"Dear HP-UX Git Maintainers,\n\nSending this email as I was trying to use the HP-UX depot file which\nwas recently committed to the\nhttp://hpux.connectinternetsolutions.com/hppd/hpux/Development/Tools/git-2.14.0/.\nI tried to use the depot file and also attempted to build the code\nfrom the adapted source code (using native HP-UX compiler as mentioned\nin Installation Note) from the website.\n\nBut unfortunately both of them failed with an error:\n\nCloning into xxxx...\nremote: Counting objects: 19813, done.\nremote: Compressing objects: 100% (9124/9124), done.\nremote: Total 19813 (delta 10340), reused 16358 (delta 8293)\nReceiving objects: 100% (19813/19813), 6.07 MiB | 9.72 MiB/s, done.\nfatal: pack is corrupted (SHA1 mismatch)\nfatal: index-pack failed\n\nLooking at the dynamic link I can see the below:\n\n_HP_DLDOPTS=\"-ldd\" /usr/bin/git\n  /usr/lib/hpux32/libpthread.so =>        /usr/lib/hpux32/libpthread.so\n  libpthread.so.1 =>      /usr/lib/hpux32/libpthread.so.1\n  libz.so =>      /usr/local/lib/hpux32/libz.so\n  libiconv.so =>  /usr/local/lib/hpux32/libiconv.so\n  libintl.so =>   /usr/local/lib/hpux32/libintl.so\n  libc.so.1 =>    /usr/lib/hpux32/libc.so.1\n  libdl.so.1 =>   /usr/lib/hpux32/libdl.so.1\n\n  Until recently we were using the older GIT version for HP-UX 1.8.5.3\nand I can see the older GIT had a dynamic link for libcrypto.so.\n\n_HP_DLDOPTS=\"-ldd\" /usr/local/bin/git\n  libz.so =>      /usr/local/lib/hpux32/libz.so\n  libiconv.so =>  /usr/local/lib/hpux32/libiconv.so\n  libintl.so =>   /usr/local/lib/hpux32/libintl.so\n  libcrypto.so => /usr/local/lib/hpux32/libcrypto.so\n  libc.so.1 =>    /usr/lib/hpux32/libc.so.1\n  libdl.so.1 =>   /usr/lib/hpux32/libdl.so.1\n\nThe clarification I have is\n1. Is the version 2.14.0 from HPUX connect is it really usable (depot\nfile and also the source code)\n2. Was it deliberate to remove the openssl linkage from the new GIT or\nam I really missing any special configure or build flags to enable the\nlibcrypto.so linkage.\n3. Is the SHA1 error which I get is it really to do with the missing\nlibcrypto.so or I am on a wrong inference track?\n\nThanks and Regards,\nJoseph John\n"},{"id":"327510","messageId":"20170901212620.w4ml5umoydbtuspw@sigill.intra.peff.net","threadId":"46694","inReplyTo":"CAC-YKd1sTQLMUZ6k+-4K09=NOa_HaOf1gp8H51VNZjziUrxOfA@mail.gmail.com","subject":"Re: HP-UX (git-2.14.0) Depot File / Source Code Build throws SHA1 Error","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2017-09-01T21:26:20Z","receivedAt":"2017-09-01T21:26:31Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Sep 01, 2017 at 03:04:36PM +0100, josephpattara . wrote:\n\n> Dear HP-UX Git Maintainers,\n> \n> Sending this email as I was trying to use the HP-UX depot file which\n> was recently committed to the\n> http://hpux.connectinternetsolutions.com/hppd/hpux/Development/Tools/git-2.14.0/.\n> I tried to use the depot file and also attempted to build the code\n> from the adapted source code (using native HP-UX compiler as mentioned\n> in Installation Note) from the website.\n\nI don't know anything about HP-UX, but I can tell you a few things from\nthe Git side...\n\n> But unfortunately both of them failed with an error:\n> \n> Cloning into xxxx...\n> remote: Counting objects: 19813, done.\n> remote: Compressing objects: 100% (9124/9124), done.\n> remote: Total 19813 (delta 10340), reused 16358 (delta 8293)\n> Receiving objects: 100% (19813/19813), 6.07 MiB | 9.72 MiB/s, done.\n> fatal: pack is corrupted (SHA1 mismatch)\n> fatal: index-pack failed\n\nAssuming there's no corruption happening on the network, it looks like\nthere's a bug in the SHA-1 routines of your build. One very basic check\nwould be to run:\n\n  echo foo | git hash-object --stdin\n\nwhich should produce:\n\n  257cc5642cb1a054f08cc83f2d943e56fd3ebe99\n\n(If it does that's not a guarantee that there aren't problems with more\ncomplex inputs, but if it produces a different sha1 that's a clear sign\nof a sha1 issue).\n\n> Looking at the dynamic link I can see the below:\n> \n> _HP_DLDOPTS=\"-ldd\" /usr/bin/git\n>   /usr/lib/hpux32/libpthread.so =>        /usr/lib/hpux32/libpthread.so\n>   libpthread.so.1 =>      /usr/lib/hpux32/libpthread.so.1\n>   libz.so =>      /usr/local/lib/hpux32/libz.so\n>   libiconv.so =>  /usr/local/lib/hpux32/libiconv.so\n>   libintl.so =>   /usr/local/lib/hpux32/libintl.so\n>   libc.so.1 =>    /usr/lib/hpux32/libc.so.1\n>   libdl.so.1 =>   /usr/lib/hpux32/libdl.so.1\n> \n>   Until recently we were using the older GIT version for HP-UX 1.8.5.3\n> and I can see the older GIT had a dynamic link for libcrypto.so.\n\nGit can build against several SHA-1 implementations. In v2.13 and up,\nthe default is the collision-detecting version publicized as part of the\nSHAttered attacks earlier this year. We have had a few problems with it\nmisbehaving on uncommon platforms or compilers, so it seems a likely\ncandidate here.\n\nYou can try building with \"make OPENSSL_SHA1=Yes\" to use openssl instead\nof the collision-detecting version. You can also try \"make BLK_SHA1=Yes\"\nif you have trouble building against openssl for whatever reason.\n\n> The clarification I have is\n> 1. Is the version 2.14.0 from HPUX connect is it really usable (depot\n> file and also the source code)\n\nThat I don't know. I took a peek at the diff between their source and a\npristine v2.14.0 tarball, and I don't see anything too exotic. So you\ncould try the upstream code from:\n\n  https://www.kernel.org/pub/software/scm/git/git-2.14.1.tar.gz\n\nbut I suspect the problem would still exist.\n\n> 2. Was it deliberate to remove the openssl linkage from the new GIT or\n> am I really missing any special configure or build flags to enable the\n> libcrypto.so linkage.\n\nYes, the default flipped but you can still change it. See above.\n\n> 3. Is the SHA1 error which I get is it really to do with the missing\n> libcrypto.so or I am on a wrong inference track?\n\nI think it's likely that you're on the right track.\n\n-Peff\n"},{"id":"327534","messageId":"CAC-YKd0dDDJ_YkT=+Euqc=AMuTYobV-dWdKHkA5SgKJVKwMeug@mail.gmail.com","threadId":"46694","inReplyTo":"20170901212620.w4ml5umoydbtuspw@sigill.intra.peff.net","subject":"Re: HP-UX (git-2.14.0) Depot File / Source Code Build throws SHA1 Error","fromName":"josephpattara .","fromEmail":"josephpattara@gmail.com","sentAt":"2017-09-04T13:01:08Z","receivedAt":"2017-09-04T13:01:17Z","isPatch":false,"sender":{"key":"josephpattara@gmail.com","avatar":null},"body":"Hello Jeff,\n\nYour information was very useful.\n\nFirstly, I could see the SHA1 hash was definitely wrong.\n-bash-4.3$ echo foo | ./git hash-object --stdin\n408935f8873a5ef17ef10cf2a316e51937e90f0b\n\nI attempted to build the code with OPENSSL_SHA1=Yes and the build is\nworking and I am able to do a git clone from my HP-UX machine. I still\nused the adapted source code HPUX connect website.\nI am wondering whether the package which was committed to the HPUX\nsite (http://hpux.connect.org.uk/) did ever worked for any one as it\nwas the same SHA1 error I was getting when I installed that depot\nfile. My HPUX architecture is below:\n\nHP-UX hepscott B.11.31 U ia64 2256017764 unlimited-user license\n\nBut I can confirm with the adapated source code from HPUX connect and\nusing the  OPENSSL_SHA1=Yes I am able to build a working git locally.\n\n\nThanks a lot.\nKind Regards,\nJoseph\n\nOn Fri, Sep 1, 2017 at 10:26 PM, Jeff King <peff@peff.net> wrote:\n> On Fri, Sep 01, 2017 at 03:04:36PM +0100, josephpattara . wrote:\n>\n>> Dear HP-UX Git Maintainers,\n>>\n>> Sending this email as I was trying to use the HP-UX depot file which\n>> was recently committed to the\n>> http://hpux.connectinternetsolutions.com/hppd/hpux/Development/Tools/git-2.14.0/.\n>> I tried to use the depot file and also attempted to build the code\n>> from the adapted source code (using native HP-UX compiler as mentioned\n>> in Installation Note) from the website.\n>\n> I don't know anything about HP-UX, but I can tell you a few things from\n> the Git side...\n>\n>> But unfortunately both of them failed with an error:\n>>\n>> Cloning into xxxx...\n>> remote: Counting objects: 19813, done.\n>> remote: Compressing objects: 100% (9124/9124), done.\n>> remote: Total 19813 (delta 10340), reused 16358 (delta 8293)\n>> Receiving objects: 100% (19813/19813), 6.07 MiB | 9.72 MiB/s, done.\n>> fatal: pack is corrupted (SHA1 mismatch)\n>> fatal: index-pack failed\n>\n> Assuming there's no corruption happening on the network, it looks like\n> there's a bug in the SHA-1 routines of your build. One very basic check\n> would be to run:\n>\n>   echo foo | git hash-object --stdin\n>\n> which should produce:\n>\n>   257cc5642cb1a054f08cc83f2d943e56fd3ebe99\n>\n> (If it does that's not a guarantee that there aren't problems with more\n> complex inputs, but if it produces a different sha1 that's a clear sign\n> of a sha1 issue).\n>\n>> Looking at the dynamic link I can see the below:\n>>\n>> _HP_DLDOPTS=\"-ldd\" /usr/bin/git\n>>   /usr/lib/hpux32/libpthread.so =>        /usr/lib/hpux32/libpthread.so\n>>   libpthread.so.1 =>      /usr/lib/hpux32/libpthread.so.1\n>>   libz.so =>      /usr/local/lib/hpux32/libz.so\n>>   libiconv.so =>  /usr/local/lib/hpux32/libiconv.so\n>>   libintl.so =>   /usr/local/lib/hpux32/libintl.so\n>>   libc.so.1 =>    /usr/lib/hpux32/libc.so.1\n>>   libdl.so.1 =>   /usr/lib/hpux32/libdl.so.1\n>>\n>>   Until recently we were using the older GIT version for HP-UX 1.8.5.3\n>> and I can see the older GIT had a dynamic link for libcrypto.so.\n>\n> Git can build against several SHA-1 implementations. In v2.13 and up,\n> the default is the collision-detecting version publicized as part of the\n> SHAttered attacks earlier this year. We have had a few problems with it\n> misbehaving on uncommon platforms or compilers, so it seems a likely\n> candidate here.\n>\n> You can try building with \"make OPENSSL_SHA1=Yes\" to use openssl instead\n> of the collision-detecting version. You can also try \"make BLK_SHA1=Yes\"\n> if you have trouble building against openssl for whatever reason.\n>\n>> The clarification I have is\n>> 1. Is the version 2.14.0 from HPUX connect is it really usable (depot\n>> file and also the source code)\n>\n> That I don't know. I took a peek at the diff between their source and a\n> pristine v2.14.0 tarball, and I don't see anything too exotic. So you\n> could try the upstream code from:\n>\n>   https://www.kernel.org/pub/software/scm/git/git-2.14.1.tar.gz\n>\n> but I suspect the problem would still exist.\n>\n>> 2. Was it deliberate to remove the openssl linkage from the new GIT or\n>> am I really missing any special configure or build flags to enable the\n>> libcrypto.so linkage.\n>\n> Yes, the default flipped but you can still change it. See above.\n>\n>> 3. Is the SHA1 error which I get is it really to do with the missing\n>> libcrypto.so or I am on a wrong inference track?\n>\n> I think it's likely that you're on the right track.\n>\n> -Peff\n"},{"id":"327539","messageId":"xmqqd175dgyp.fsf@gitster.mtv.corp.google.com","threadId":"46694","inReplyTo":"CAC-YKd0dDDJ_YkT=+Euqc=AMuTYobV-dWdKHkA5SgKJVKwMeug@mail.gmail.com","subject":"Re: HP-UX (git-2.14.0) Depot File / Source Code Build throws SHA1 Error","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-09-05T02:20:14Z","receivedAt":"2017-09-05T02:20:24Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"josephpattara .\" <josephpattara@gmail.com> writes:\n\n> Firstly, I could see the SHA1 hash was definitely wrong.\n> -bash-4.3$ echo foo | ./git hash-object --stdin\n> 408935f8873a5ef17ef10cf2a316e51937e90f0b\n> ...\n> But I can confirm with the adapated source code from HPUX connect and\n> using the  OPENSSL_SHA1=Yes I am able to build a working git locally.\n\nI do not know if your HP-UX on Itanium is big/little endian (IIRC it\nis selectable at the CPU level), but my blind guess is that this\nmight help before building without OPENSSL_SHA1=YesPlease?\n\n        cat >>config.mak <<-\\EOF\n        BASIC_CFLAGS += -DSHA1DC_FORCE_BIGENDIAN=1\n        EOF\n"}]}