[Pkg-varnish-devel] Bug#743307: varnish: hash sum of tar balls in mirrors differ

[Lukas Anzinger]

Package: varnish
Version: 2.1.3-8+deb6u2
Severity: normal

Hi,

the hash sums of varnish_2.1.3.orig.tar.gz from security.debian.org and the
one from ftp.de.debian.org are different.

$ wget -q -O - http://security.debian.org/debian-security/pool/updates/main/v/varnish/varnish_2.1.3.orig.tar.gz
| sha1sum -
730eea869b6aabace6e3e638c743d722f5f67fd7  -
$ wget -q -O - http://ftp.de.debian.org/debian/pool/main/v/varnish/varnish_2.1.3.orig.tar.gz
| sha1sum -
574e9d94405a017102a0b53156d12197a669f053  -

This is quite annoying for me because I combine all squeeze distributions
(squeeze, squeeze-updates, squeeze/updates in case of debian-security) to
one using reprepro. Reprepro complains that it can't import varnish
2.1.3-8+deb6u2 because varnish_2.1.3.orig.tar.gz from security.debian.org has
a different hash sum than varnish_2.1.3.orig.tar.gz from ftp.de.debian.org.

I'd really appreciate an upload of the package using the orig tar ball
uploaded to security.debian.org.

Regards,

Lukas