Roundcube Checksum error

1

Trying to do an upgrade, but having an error with the roundcube-1.1.3 package checksum. Not sure if the package or the checksum is invalid.

Primary Hostname: xxxxx Public IP Address: yyyyyyyyyyyy Mail-in-a-Box Version: v0.16

Updating system packages…
Installing system packages…
Initializing system random number generator…
Installing nsd (DNS server)…
Installing Postfix (SMTP server)…
Installing Dovecot (IMAP server)…
Installing OpenDKIM/OpenDMARC…
Installing SpamAssassin…
Installing Nginx (web server)…
Installing Roundcube (webmail)…
sha1sum: WARNING: 1 computed checksum did NOT match

Download of hxxxs://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz did not match expected checksum.
Found:
ea60df615387f47bdfdfe4da48f6567c4ec60f74 /tmp/roundcube.tgz

Expected:
4513227bd64eb8564f056817341b1dfe478e215e /tmp/roundcube.tgz

root@leguin:/# wget -O - hxxxs://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz | sha1sum --2016-02-19 22:49:39-- hxxxxs://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz Resolving downloads.sourceforge.net (downloads.sourceforge.net)... 54.230.90.163, 54.230.90.200, 54.230.90.209, ... Connecting to downloads.sourceforge.net (downloads.sourceforge.net)|54.230.90.163|:443... connected. HTTP request sent, awaiting response... 302 Moved Temporarily Location: hxxx://downloads.sourceforge.net/#!/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz [following] --2016-02-19 22:49:39-- hxxx://downloads.sourceforge.net/ Connecting to downloads.sourceforge.net (downloads.sourceforge.net)|54.230.90.163|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 639 [text/html] Saving to: 'STDOUT'

100%[======================================>] 639 --.-K/s in 0s

2016-02-19 22:49:40 (73.8 MB/s) - written to stdout [639/639]

ea60df615387f47bdfdfe4da48f6567c4ec60f74 -

p.s. probably bad form from a security perspective to use predictable filenames in /tmp… haven’t looked at the setup script but can leave to some exposure locally that way.

2

I’m getting the same error. It seems that SourceForge had changed the way it redirects to the mirror and now https://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz lands on a web page with a countdown. Or my nearest mirror is dead and that messes up roundcube installation.

I’m augmenting https to httpZ below to get around 2-link policy on the forum.

$ wget -O - httpZ://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz | sha1sum
…
–2016-03-09 02:03:55-- httpZ://downloads.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz
Resolving downloads.sourceforge.net (downloads.sourceforge.net)… 216.34.181.59
Connecting to downloads.sourceforge.net (downloads.sourceforge.net)|216.34.181.59|:443… connected.
HTTP request sent, awaiting response…
HTTP/1.1 307 Temporary Redirect
…
Location: httpZ://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz/download?use_mirror=iweb
Content-Length: 460
Location: httpZ://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz/download?use_mirror=iweb [following]
–2016-03-09 02:03:56-- http(no S)://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz/download?use_mirror=iweb
Resolving sourceforge.net (sourceforge.net)… 216.34.181.60
Connecting to sourceforge.net (sourceforge.net)|216.34.181.60|:80… connected.
HTTP request sent, awaiting response…
HTTP/1.1 301 Moved Permanently
…
Location: httpZ://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz/download?use_mirror=iweb
…
–2016-03-09 02:03:57-- httpZ://sourceforge.net/projects/roundcubemail/files/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz/download?use_mirror=iweb
Connecting to sourceforge.net (sourceforge.net)|216.34.181.60|:443… connected.
HTTP request sent, awaiting response…
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 08 Mar 2016 18:03:58 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Pragma: no-cache
Cache-Control: no-cache
X-UA-Compatible: IE=edge,chrome=1
X-Frame-Options: SAMEORIGIN
Set-Cookie: VISITOR=COOKIE; expires=“Fri, 06-Mar-2026 18:03:58 GMT”; httponly; Max-Age=315360000; Path=/
Set-cookie: sourceforge=ANOTHER COOKIE; expires=Tue, 19-Jan-2038 03:14:07 GMT; httponly; Path=/; secure
Content-Length: 60042
X-Content-Type-Options: nosniff
Length: 60042 (59K) [text/html]
Saving to: ‘-.html’

100%[==================================================================================================================================================================>] 60,042 87.3KB/s in 0.7s

2016-03-09 02:03:59 (87.3 KB/s) - written to stdout [60042/60042]

670534e2b7816cabbb67b10c312b20d830255fbb -

Checksum is different for every request and it now fails the test.

If I manually change a URL to http://nchc.dl.sourceforge.net/project/roundcubemail/roundcubemail/1.1.3/roundcubemail-1.1.3.tar.gz in setup/webmail.sh and then run setup/start.sh, it goes through the whole process without any error messages, but roundcube is still not installed.

Nothing significant in syslog.

3

Could you open an issue on the github project for this? Looks like we’ll have to host our own mirror of the Roundcube package.

1 Like
4

Sure thing, here you go: https://github.com/mail-in-a-box/mailinabox/issues/750

I haven’t yet moved my primary email to MIAB, so would be happy to run whatever tests would help, provide logs and even purge the VPS.

Thanks for doing all this hard work, @JoshData. Appreciate your work immensely!