Questions regarding Postgis 3.4.2 distribution-tarballs and MD5 hash

[Steve Underwood]

In an attempt to build the PostGIS 3.4.2 release from source, I downloaded both the "postgis-3.4.2.tar.gz" and "postgis-3.4.2.tar.gz.md5" files using the links provided on the "postgis.net/development/source_code/" web-page.  As part of the build procedure being utilized, the MD5 hash in the "postgis-3.4.2.tar.gz.md5" file  (i.e., 9298e0a81013b44ac39cfbabf2f95ae9) is compared against an MD5 hash generated locally for the downloaded copy of the "postgis-3.4.2.tar.gz" file (i.e., 632abda8b4267af437db6cde1bc9d9dc) and due to the difference in hash values, that comparison is failing.

Wondering if the distribution-tarball being referenced on the "postgis.net/development/source_code/" web-page was somehow incorrect, I downloaded the distribution-tarball directly from the PostGIS GIT repository (using the "TAR.GZ" link for the 3.4.2 release listed on the "git.osgeo.org/gitea/postgis/postgis/tags" web-page).  Once downloaded, I noticed:


  1.  an MD5-hash generated locally for it (i.e.,  6a173d78eb02a9aad7bea6111338c8a2) still differed from the MD5 hash in the "postgis-3.4.2.tar.gz.md5" file; and
  2.  a difference in size between the  "postgis.net/development/source_code/" web-page sourced distribution-tarball (14957647 bytes) and the "git.osgeo.org/gitea/postgis/postgis/tags" web-page sourced distribution-tarball (14454813 bytes).

Please note it was "openssl dgst -md5 ..." command invocation that were used to generate the local MD5 hash values against the downloaded distribution-tarballs and that if I choose to ignore the MD5 hash discrepancies, the PostGIS 3.4.2 release builds successfully.

I would, however, feel more comfortable if the MD5 hash value provided for the 3.4.2 release aligned with the value that can be locally generated against the PostGIS  3.4.2 distribution-tarball.  As the hash comparison process was used successfully about 6 months ago with the 3.4.1 PostgGIS release, I suspect the issue is an incorrect MD5 hash value being posted for the PostGIS 3.4.2 release on the
"postgis.net/development/source_code/" web-page.  Could somebody from the PostGIS maintenance team confirm this and if so, provide the correct MD5 hash value to the "postgis-3.4.2.tar.gz.md5" file?

Many thanks for your time.

Stephen Underwood,
Versaterm Public Safety
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/postgis-users/attachments/20240530/6cfcf5dc/attachment.htm>