Roundcubemail: ERROR: Incorrect sha1 sum of /tmp/tinymce-4.5.8.zip

[RalfJung]

Running installto.sh from the roundcube 1.4.1 tarball on my server shows an error message:

Installing tinymce...
ERROR: Incorrect sha1 sum of /tmp/tinymce-4.5.8.zip. Expected: 08b0757264adb86066940bbafb7aa9ec0c7c6685, got: da39a3ee5e6b4b0d3255bfef95601890afd80709
done.

The script the continues, but... should I be worried?

[alecpl]

I don't see a bug here. The file it downloaded might be malformed or something else. SO, it stops processing that file. You can remove the file from Roundcube temp folder and execute install-jsdeps.sh tinymce script to do only this part again.

[RalfJung]

I did rm /tmp/tinymce-4.5.8.zip and tried installto again, and the error persists.

Then I did rm /tmp/tinymce-4.5.8.zip again and tried ./install-jsdeps.sh tinymce.

However, when I wget 'http://download.ephox.com/tinymce/community/tinymce_4.5.8.zip' in the same machine and check the sha1sum of that file, I do get 08b0757264adb86066940bbafb7aa9ec0c7c6685.

So, to me it looks like something is wrong with the install script or so -- this is not just a download going wrong once.

[RalfJung]

Turns out the bug is actually in curl: when I download the file with curl, it is empty. I an reproduce this on another machine that also uses Debian Stretch. On my laptop (Debian testing), curl downloads the file correctly.

$ curl --version
curl 7.52.1 (x86_64-pc-linux-gnu) libcurl/7.52.1 OpenSSL/1.0.2t zlib/1.2.8 libidn2/0.16 libpsl/0.17.0 (+libidn2/0.16) libssh2/1.7.0 nghttp2/1.18.1 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL

[RalfJung]

Ah actually the bug is in your script. The URL you are using is a redirect, and curl per default does not follow redirects. Looks like that default changed with later versions. You need to add the -L flag.

[johndoh]

dupe of #6694

[alecpl]

But 1.4.1 should have the URL fixed in jsdeps.json, so why it's using the old one? Maybe the installer failed to replace/move that file or sth?

[RalfJung]

The 1.4.1 tarball (roundcubemail-1.4.1-complete.tar.gz) doesn't even contain a install-jsdeps.sh:

$ ls roundcubemail-1.4.1/bin/ -lah
total 88K
drwxr-xr-x  2 r r  310 Nov 27 19:26 .
drwxr-xr-x 13 r r 4,0K Nov 19 21:20 ..
-rwxr-xr-x  1 r r 1,3K Nov 19 21:20 cleandb.sh
-rwxr-xr-x  1 r r 1,7K Nov 19 21:20 cssshrink.sh
-rwxr-xr-x  1 r r 2,7K Nov 19 21:20 decrypt.sh
-rwxr-xr-x  1 r r 4,9K Nov 19 21:20 deluser.sh
-rwxr-xr-x  1 r r 1,7K Nov 19 21:20 gc.sh
-rwxr-xr-x  1 r r 1,4K Nov 19 21:20 indexcontacts.sh
-rwxr-xr-x  1 r r 1,7K Nov 19 21:20 initdb.sh
-rwxr-xr-x  1 r r 6,0K Nov 19 21:20 installto.sh
-rwxr-xr-x  1 r r 2,1K Nov 19 21:20 jsshrink.sh
-rwxr-xr-x  1 r r  537 Nov 19 21:20 makedoc.sh
-rwxr-xr-x  1 r r 2,3K Nov 19 21:20 moduserprefs.sh
-rwxr-xr-x  1 r r 4,3K Nov 19 21:20 msgexport.sh
-rwxr-xr-x  1 r r 3,6K Nov 19 21:20 msgimport.sh
-rwxr-xr-x  1 r r 3,7K Nov 19 21:20 updatecss.sh
-rwxr-xr-x  1 r r 1,8K Nov 19 21:20 updatedb.sh
-rwxr-xr-x  1 r r  12K Nov 19 21:20 update.sh

[alecpl]

That is correct. Complete version does not need it, so there's also no jsdeps.json file. It looks that you're updating a version that contains both with a version that does not have them. And this is not properly detected by the installto.sh script.

I guess we should only execute install-jsdeps.sh when jsdeps.json exists in the source directory. @thomascube what do you think?

[RalfJung]

This installation has been updated many times, and while I think I always used the "complete" tarball it is very possible that I picked the wrong one once - and since then the installation might be in a "mixed" state?

[thomascube]

I guess we should only execute install-jsdeps.sh when jsdeps.json exists in the source directory. @thomascube what do you think?

Maybe print a warning. Anyway this is a freak case and very likely a human error. Neither jsdeps.json nor bin/install-jsdeps.sh are part of the complete package.

[RalfJung]

Might this happen when one accidentally uses the non-complete installer once to update a "complete" installation?

[alecpl]

@RalfJung this looks like a opposite situation. Your installation contains jsdeps.json file that do not exist in the package you're updating to. So, the dependencies are included in the package and installer should not run install-jsdeps.sh script because it will install old versions of dependencies, rewriting newer ones.

In your case probably removing jsdeps.json before upgrade should be enough, but you may have other issues e.g. with composer dependencies (if you're using composer at all).

I added a warning to the installer script and it will skip install-jsdeps.sh call in such cases.

[RalfJung]

Your installation contains jsdeps.json file that do not exist in the package you're updating to.

I am pretty sure I originally started with the complete installer, but one of the several dozen updates I installed since then might be the non-complete version.

Do I need to "fix" my installation? How so?