Tribler: Latest deb package for Tribler v7.4.0 is incorrect and checksum errors

[NoNameForMee]

Please, fill all relevant items:

• [x] I have read CONTRIBUTING.rst

• [x] I have tried with the latest pre-release version and I still can reproduce the issue.

Tribler version/branch+revision:

https://github.com/Tribler/tribler/releases/tag/v7.4.0

Operating system and version:

Ubuntu 18.04

Steps to reproduce the behavior:

Download the assets (checksum, signature and .deb/.dmg/.exe files) related to the v7.4.0 tag from a few days ago. And notice that it has incorrect version information in the deb package.

Expected behavior:

Package should contain Tribler v7.4.0 as is indicated by the tag/release note. And checksum and signatures should all match.

Actual behavior:

Check the internal information of the deb file:

$ dpkg-deb -I tribler_7.4.0_all.deb 
 new Debian package, version 2.0.
 size 2533584 bytes: control archive=25868 bytes.
    1484 bytes,    23 lines      control              
  158546 bytes,  1517 lines      md5sums              
     566 bytes,    14 lines   *  postinst             #!/bin/sh
     174 bytes,     5 lines   *  postrm               #!/bin/sh
     319 bytes,    14 lines   *  prerm                #!/bin/sh
 Package: tribler
 Version: 7.0.0
... and so on..

This appears to be an incorrect file version (7.0.0 vs tag/release 7.4.0)!

Check the SHA256.txt file match the signature (which it does):

$ gpg2 --verify SHA256.txt{.asc,}
gpg: Signature made Sat Feb  1 02:53:39 2020 CET
gpg:                using RSA key 700924EB2BF09E54920751549DD1E058B9FCA9DC
gpg: Good signature from "Johan Pouwelse (Tribler signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7009 24EB 2BF0 9E54 9207  5154 9DD1 E058 B9FC A9DC

Check the checksum SHA256 against the deb file:

$ sha256sum -c SHA256.txt
Tribler_7.4.0_x64.exe: OK
Tribler_7.4.0_x86.exe: OK
Tribler-7.4.0.dmg: OK
sha256sum: tribler_7.0.0_all.deb: No such file or directory
tribler_7.0.0_all.deb: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read

Here we notice that the SHA256.txt file tries to check for a tribler_7.0.0.deb (wrong version again). While the .exe and .dmg files are all OK..

Computing the sha256 checksum for the downloaded tribler_7.4.0.deb however gets the same sum as the SHA256.txt file lists for tribler_7.0.0.deb, namely:

$ sha256sum tribler_7.4.0_all.deb 
3d94cec44f53d851ca685c73d2469b72b0c8c6be8319ca1a876df5d039151946  tribler_7.4.0_all.deb

[xoriole]

@NoNameForMee It seems there is an issue in the build script regarding the naming. tribler_7.0.0.deb is the default build which should be renamed to the latest version tribler_7.4.0_all.deb. I'll look into it. Thanks for pointing out.

[xoriole]

Update: The Debian package and the checksums are updated.

[devos50]

@xoriole thanks! Is this issue then addressed?

[xoriole]

@devos50 Yes.
@NoNameForMee Would you like to confirm?

[NoNameForMee]

Dear @xoriole,
I hate to be pedantic but...

The original issue appears to be solved (for tribler_7.4.0_all.deb), however looking closely at the new SHA256.txt file it appears that the checksum for the other files now no longer agree as it should... (And yes, I did download them all again from the assets listed https://github.com/Tribler/tribler/releases/tag/v7.4.0).

The version string looks to be corrected in the .deb package:

$ dpkg-deb -I tribler_7.4.0_all.deb
 new Debian package, version 2.0.
 size 2533052 bytes: control archive=25864 bytes.
    1484 bytes,    23 lines      control              
  158546 bytes,  1517 lines      md5sums              
     566 bytes,    14 lines   *  postinst             #!/bin/sh
     174 bytes,     5 lines   *  postrm               #!/bin/sh
     319 bytes,    14 lines   *  prerm                #!/bin/sh
 Package: tribler
 Version: 7.4.0
... and so on..

And the checksum is OK for the new package, however the other files now fail..

$ shasum -c SHA256.txt
Tribler_7.4.0_x64.exe: FAILED
Tribler_7.4.0_x86.exe: FAILED
Tribler-7.4.0.dmg: FAILED
tribler_7.4.0_all.deb: OK

Based on the checksum file containing:

$ cat SHA256.txt
c47877f2630f554319516db64979e5fc31464aa1299c132871a75d907e36a640  Tribler_7.4.0_x64.exe
318a7f53f5120f42134835b37b356a748d33232a09a8582bf5d54a5e2b7b2955  Tribler_7.4.0_x86.exe
25bcde56a5005150b153b8be9dbf05b7c2fa1972ae7134a4b2b8501f5cc7287d  Tribler-7.4.0.dmg
05a4ab6b8ecc620f4f803b39c07978e77e62babb3611bb7d3bfc466924d7a4dd  tribler_7.4.0_all.deb

Which is the newly signed checksum file:

$ gpg2 --verify SHA256.txt{.asc,}
gpg: Signature made Mon Feb  3 09:34:12 2020 CET
gpg:                using RSA key 700924EB2BF09E54920751549DD1E058B9FCA9DC
gpg: Good signature from "Johan Pouwelse (Tribler signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7009 24EB 2BF0 9E54 9207  5154 9DD1 E058 B9FC A9DC

[xoriole]

@NoNameForMee Thank you for pointing out. Previously, I only uploaded the deb and checksum files. I now re-uploaded all the build files. The checksum and signature should match now.