possible security problem? FreeBSD Port: www/adzap

[B. Cook]

Hello all,

Strange thing going on w/ adzap.. possible problem on the server?

Seems as if md5/sha256 doesn't match.. but the size is right.

the -vista- box is a new install..

root at vista [/usr/ports/www/adzap]# 99 > make distclean
===>  Cleaning for adzap-20090301
===>  Deleting distfiles for adzap-20090301

root at vista [/usr/ports/www/adzap]# 100 > make
===>  Vulnerability check disabled, database not found
=> adzap-20090301.tar.gz doesn't seem to exist in /usr/ports/distfiles/.
=> Attempting to fetch from http://adzapper.sourceforge.net/.
adzap-20090301.tar.gz                         100% of  490 kB  549 kBps
===>  Extracting for adzap-20090301
=> MD5 Checksum mismatch for adzap-20090301.tar.gz.
=> SHA256 Checksum mismatch for adzap-20090301.tar.gz.
===>  Refetch for 1 more times files: adzap-20090301.tar.gz 
adzap-20090301.tar.gz
===>  Vulnerability check disabled, database not found
=> adzap-20090301.tar.gz doesn't seem to exist in /usr/ports/distfiles/.
=> Attempting to fetch from http://adzapper.sourceforge.net/
fetch: http://adzapper.sourceforge.net/adzap-20090301.tar.gz: Requested 
Range Not Satisfiable
=> Attempting to fetch from 
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/.
fetch: adzap-20090301.tar.gz: local modification time does not match remote
=> Couldn't fetch it - please try to retrieve this
=> port manually into /usr/ports/distfiles/ and try again.
*** Error code 1

Stop in /usr/ports/www/adzap.
*** Error code 1

Stop in /usr/ports/www/adzap.


I have another copy of adzap-20090301.tar.gz on another box (from march) 
and I copy that over and replace the one in distfiles and it all 
compiles just fine..

root at vista [/usr/ports/www/adzap]# 101 > make distclean
===>  Cleaning for adzap-20090301
===>  Deleting distfiles for adzap-20090301

root at vista [/usr/ports/www/adzap]# 102 > md5 
/home/bcook/adzap-20090301.tar.gz
MD5 (/home/bcook/adzap-20090301.tar.gz) = acc2225a2b70f51e13d6919bca6a4bc3

root at vista [/usr/ports/www/adzap]# 103 > sha256 
/home/bcook/adzap-20090301.tar.gz
SHA256 (/home/bcook/adzap-20090301.tar.gz) = 
6fe77885cd8a2cb925ffcceb91a174800c13e43476ac2f3113b641189cd77968

root at vista [/usr/ports/www/adzap]# 104 > cp 
/home/bcook/adzap-20090301.tar.gz /usr/ports/distfiles/

root at vista [/usr/ports/www/adzap]# 105 > make
===>  Vulnerability check disabled, database not found
===>  Extracting for adzap-20090301
=> MD5 Checksum OK for adzap-20090301.tar.gz.
=> SHA256 Checksum OK for adzap-20090301.tar.gz.
===>  Patching for adzap-20090301
===>  Applying FreeBSD patches for adzap-20090301
===>  Configuring for adzap-20090301
/usr/bin/sed -i.bak -e "s:/usr/bin/perl:/usr/local/bin/perl5.10.1:g"  -e 
"s:%%PREFIX%%:/usr/local:g" 
/usr/ports/www/adzap/work/adzap-20090301/scripts/squid_redirect
/usr/bin/sed -i.bak -e "s:/usr/bin/perl:/usr/local/bin/perl5.10.1:g"  -e 
"s:%%PREFIX%%:/usr/local:g" 
/usr/ports/www/adzap/work/adzap-20090301/scripts/wrapzap
/usr/bin/sed -i.bak -e "s:/usr/bin/perl:/usr/local/bin/perl5.10.1:g"  -e 
"s:%%PREFIX%%:/usr/local:g" 
/usr/ports/www/adzap/work/adzap-20090301/scripts/zapchain


So I think its odd; and think that possibly someone changed something in 
the file on the adzap server?

(yes curl is out of date.. hence why I'm updating the server to begin 
with.. :) )

* About to connect() to adzapper.sourceforge.net port 80 (#0)
*   Trying 216.34.181.96... connected
* Connected to adzapper.sourceforge.net (216.34.181.96) port 80 (#0)
 > HEAD /adzap-20090301.tar.gz HTTP/1.1
 > User-Agent: curl/7.18.0 (i386-portbld-freebsd6.2) libcurl/7.18.0 
OpenSSL/0.9.7e zlib/1.2.3
 > Host: adzapper.sourceforge.net
 > Accept: */*
 >
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: nginx/0.7.61
Server: nginx/0.7.61
< Date: Tue, 06 Oct 2009 01:36:11 GMT
Date: Tue, 06 Oct 2009 01:36:11 GMT
< Content-Type: application/x-gzip
Content-Type: application/x-gzip
< Connection: keep-alive
Connection: keep-alive
< Last-Modified: Mon, 24 Aug 2009 07:36:19 GMT
Last-Modified: Mon, 24 Aug 2009 07:36:19 GMT
< ETag: "7a800-471de461062c0"
ETag: "7a800-471de461062c0"
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Content-Length: 501760
Content-Length: 501760
< Cache-Control: max-age=172800
Cache-Control: max-age=172800
< Expires: Thu, 08 Oct 2009 01:36:11 GMT
Expires: Thu, 08 Oct 2009 01:36:11 GMT

<
* Connection #0 to host adzapper.sourceforge.net left intact
* Closing connection #0