Greetings, At the moment, I am unable to upgrade my hppa boxes, there are error messages like "Hash Sum mismatch" or "File has unexpected size".
Example: | Error: Failed to fetch http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb Hash Sum mismatch | Hashes of expected file: | - SHA256:f45b842483a27a32e8401e44cd9efdd06d308fc744a727c9d29d591893eb2a66 | - MD5Sum:7b21e02df40e6a7f8174abd101f0c17f [weak] | - Filesize:8356 [weak] | Hashes of received file: | - SHA256:7b26f5b086ed5b2e950858490ff4539d80fb60444110c5ffc6d10eec0b396c83 | - MD5Sum:c8c1f443fd3252d563384d56a0435754 [weak] | - Filesize:8356 [weak] | Last modification reported: Thu, 18 Jun 2026 18:03:13 +0000 Affected are these URLs: http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libgomp1_16.1.0-2_hppa.deb http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libgcc-s4_16.1.0-2_hppa.deb http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libcc1-0_16.1.0-2_hppa.deb http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libstdc%2b%2b6_16.1.0-2_hppa.deb Now I'm fairly certain this is outside my control. A check on a second mirror returned the same result. Can someone take a look into this? These are the steps to reproduce: $ wget http://ftp.de.debian.org/debian-ports/dists/sid/main/binary-hppa/Packages.xz $ TZ=UTC stat --format='%Y (%y)' Packages.xz 1782049495 (2026-06-21 13:44:55.000000000 +0000) $ xzgrep -A13 '^Package: libatomic1$' Packages.xz Package: libatomic1 Architecture: hppa Version: 16.1.0-2 Multi-Arch: same Priority: optional Section: libs Source: gcc-16 Maintainer: Debian GCC Maintainers <[email protected]> Installed-Size: 48 Depends: gcc-16-base (= 16.1.0-2), libc6 (>= 2.2) Filename: pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb Size: 8356 MD5sum: 7b21e02df40e6a7f8174abd101f0c17f SHA256: f45b842483a27a32e8401e44cd9efdd06d308fc744a727c9d29d591893eb2a66 => These are the "expected" hashsums as above. $ TZ=UTC stat --format='%Y (%y)' libatomic1_16.1.0-2_hppa.deb 1781805793 (2026-06-18 18:03:13.000000000 +0000) $ wget http://ftp.de.debian.org/debian-ports/pool-hppa/main/g/gcc-16/libatomic1_16.1.0-2_hppa.deb $ TZ=UTC stat --format='%Y (%y)' libatomic1_16.1.0-2_hppa.deb 1781805793 (2026-06-18 18:03:13.000000000 +0000) $ md5sum libatomic1_16.1.0-2_hppa.deb ; sha256sum libatomic1_16.1.0-2_hppa.deb c8c1f443fd3252d563384d56a0435754 libatomic1_16.1.0-2_hppa.deb 7b26f5b086ed5b2e950858490ff4539d80fb60444110c5ffc6d10eec0b396c83 libatomic1_16.1.0-2_hppa.deb => These are the "received" hashsums as above. So my assumption is mirror content and index (Packages) ran out of sync. In quite a weird way. Whom to ping for a check? Further information, based on the mtime: The "received" package was installed on the mirror on 1781589787 (2026-06-16T06:03:07) and appearently replaced with the "expected" content on 1781805793 (2026-06-18 18:03:13.886190374 +0000). While TTBOMK there is no guarantee a Debian package file name is unique in a mirror, violating that causes confusion. Christoph
signature.asc
Description: PGP signature
