Tracking Issue: Package overwrite

[ruben-arts]

There has been a recent build that (we prefix.dev`) believe to have caused packages to be overwritten by newly build packages.

The reason that we "think" that is due to an issue it exposed in our prefix.dev/robostack-humble mirror. It was serving broken repodata where the sha256 sum was updated but not the md5 sum. This was a bug on our side, and we fixed that, but the code logic showed that we only update the sha256 and not the md5 when a package overwrites in a mirrored channel.

This isn't a reason for direct action, but if users encounter broken packages, we might need to investigate further what happened.

Related errors you might have encountered

pixi install

throwing:

thread 'tokio-runtime-worker' panicked at /Users/runner/miniforge3/conda-bld/bld/rattler-build_pixi_1757399390/build_env/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/time/entry.rs:602:9:
A Tokio 1.x context was found, but it is being shutdown.
Error:   × failed to fetch ros-humble-ament-cmake-include-directories-1.3.7-py311hbfa132e_5.tar.bz2
  ╰─▶ hash mismatch when extracting https://prefix.dev/robostack-staging/osx-arm64/ros-humble-ament-cmake-include-directories-1.3.7-py311hbfa132e_5.tar.bz2 to /Users/user/Library/Caches/rattler/
      cache/pkgs/ros-humble-ament-cmake-include-directories-1.3.7-py311hbfa132e_5: expected bf388ed145c677c1080327ffda223406, got 629d787fb49a51cc1994d017eeb54948, total size 11864 bytes

[traversaro]

Thanks! I really do not know how that could have happened. Did you checked which hash is used on anaconda.org ? The "new" or the "old" one? On the prefix.dev side do you have some kind of trace to understand when this "package overwrites in a mirrored channel" happened?

[traversaro]

I may be wrong, but are you sure that this happened on robostack-humble and not robostack-staging ? The error refers to robostack-staging, and indeed the ros-humble-ament-cmake-include-directories-1.3.7-py311hbfa132e_5 package is only available in robostack-staging, not robostack-humble.