Bug 381882

Description Tobias Oberlies 2012-06-06 12:14:37 EDT

AFAIK, all pack200 compressed artifacts in the common Eclipse.org repositories don't have the download.md5 property set (see publisher bug 271707).

When mirroring such an artifact with org.eclipse.equinox.internal.p2.artifact.repository.MirrorRequest (i.e. a mirror operation that involves the processing steps), a corruption on the network (or in the unpack200 step) is *not* detected. The only processing step that comes after the unpack, the org.eclipse.equinox.internal.p2.artifact.repository.SignatureVerifier, reports that the file is not signed if the artifact isn't a ZipFile any more.

We reconstructed that the exception when opening the corrupted file is caught here:
	at org.eclipse.osgi.baseadaptor.bundlefile.ZipBundleFile.checkedOpen(ZipBundleFile:73)
	at org.eclipse.osgi.baseadaptor.bundlefile.ZipBundleFile.getEntry(ZipBundleFile:245)
	at org.eclipse.osgi.internal.signedcontent.SignatureBlockProcessor.process(SignatureBlockProcessor:38)
	at org.eclipse.osgi.internal.signedcontent.SignedBundleFile.setBundleFile(SignedBundleFile:47)
	at org.eclipse.osgi.internal.signedcontent.SignedBundleHook.getSignedContent(SignedBundleHook:256)
	at org.eclipse.equinox.internal.p2.artifact.repository.SignatureVerifier.verifyContent(SignatureVerifier:77)

The problem of successfully mirrored, corrupted artifacts can be regularly seen in Tycho builds (bug 373173) if you happen to be behind a proxy with "bad days".