mixu/npm_lazy

Shasum check failed

Closed this issue · 3 comments

Not sure if this is related to #3 but we noticed that occasionally we come across a cached npm module that fails a checksum, here is a sample:

npm http GET https://npm_lazy.makerin.com/readable-stream/1.1.10
npm http 200 https://npm_lazy.makerin.com/readable-stream/1.1.10
npm http GET https://npm_lazy.makerin.com/readable-stream/-/readable-stream-1.1.10.tgz
npm http 200 https://npm_lazy.makerin.com/readable-stream/-/readable-stream-1.1.10.tgz
npm ERR! Error: shasum check failed for /home/ed/tmp/npm-27120-40gG7Kf9/1391030168947-0.10126865236088634/tmp.tgz
npm ERR! Expected: d4dc2e5319e9c90d1e71c69390ef62cd90827f65
npm ERR! Actual: d40a009ef90e795283653b2fb8e601a26d83113b
npm ERR! at /usr/local/lib/node_modules/npm/node_modules/sha/index.js:38:8
npm ERR! at ReadStream. (/usr/local/lib/node_modules/npm/node_modules/sha/index.js:85:7)
npm ERR! at ReadStream.EventEmitter.emit (events.js:117:20)
npm ERR! at _stream_readable.js:920:16
npm ERR! at process._tickCallback (node.js:415:13)
npm ERR! If you need help, you may report this entire log,
npm ERR! including the npm and node versions, at:
npm ERR! http://github.com/isaacs/npm/issues

At that point our only option is to purge the entire cache, is there a process for purging individual modules?

Thanks

mixu commented

Yeah I've seen this occur once, but haven't been able to replicate it. Right now you'd need to purge the cache.

I think a good step might be to write a basic self check routine on the stuff in cachePath/meta.json using lib/verify.js getSha and check which would be run on all cached items when npm_lazy is restarted. If you have some time I'd love a PR otherwise I'll do it at some (later) point..

This bug happens when the package author updates the package file on the registry without bumping the version, resulting in checksum mismatch between the cached file (which never gets re-fetched) and the metadata (which is periodically re-fetched). PR #27 fixes this issue.

mixu commented

thanks @univerio - that makes sense! I'll merge the PR now and try to document / test/ release it tomorrow.