vcpkg_from_gitlab changes checksum on every download

[cacharle]

The hash of the download when using vcpkg_from_gitlab changes on every download.

First run:

$ cmake ....
...
Downloading https://gitlab.company.com/group/repo/ref.tar.gz -> ref.tar.gz
ref.tar.gz.27508.part: error: download from ref.tar.gz had an unexpected hash
note: Expected: 77832d8ecc926351a7d50ef258575e62040d38c699e01b5d1003ce177f9538f25ec6658a3ec87e7fba12688b2de598249c66cec64b845324439c8ed23a615357
note: Actual  : d71169f9fc97bf8c138ce85ee875960fe648550d8d796ed97e98d0b49183fb7c35bb29708c78b59c760365d996d7ca87c7e72ccd9706912d87760a317635fabd
...

Then I run it a second time (no file change whatsoever):

$ cmake ....
...
Downloading https://gitlab.company.com/group/repo/ref.tar.gz -> ref.tar.gz
ref.tar.gz.27508.part: error: download from ref.tar.gz had an unexpected hash
note: Expected: 77832d8ecc926351a7d50ef258575e62040d38c699e01b5d1003ce177f9538f25ec6658a3ec87e7fba12688b2de598249c66cec64b845324439c8ed23a615357
note: Actual  : 38b6c4bcdc7bd9d07eccb1e4768a2c7d6e157e3a96520398ef1dd27bbf346b348679f8b9e155545a46b7e6a9da833581d703217dcaf229fab4765b21e0f7fec3
...

[dg0yt]

AFAICS it is not vcpkg_from_gitlab but https://gitlab.company.com/group/repo/ref.tar.gz which is changing.

[cacharle]

When I download the archive manually, the hash stay the same:

$ curl --header 'PRIVATE-TOKEN: TOKEN'  -L https://gitlab.company/repo/-/archive/v0.0.2/repo-v0.0.2.zip -o out.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  172k    0  172k    0     0   249k      0 --:--:-- --:--:-- --:--:--  249k

$ Get-FileHash out.zip -Algorithm SHA512 | format-list

Algorithm : SHA512
Hash      : 1AEEA5E826A91A8C2F48FDB9F9B0139D8293618D8452AA2449B8CE88429D5F9B27E51E40476CF6B266E91FD1E63DB8EF4F96A608ABC02A08C04783AF63407CD4
Path      : C:\Users\xxx


$ curl --header 'PRIVATE-TOKEN: TOKEN'  -L https://gitlab.company/repo/-/archive/v0.0.2/repo-v0.0.2.zip -o out.zip
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  172k  100  172k    0     0   354k      0 --:--:-- --:--:-- --:--:--  354k

$ Get-FileHash out.zip -Algorithm SHA512 | format-list

Algorithm : SHA512
Hash      : 1AEEA5E826A91A8C2F48FDB9F9B0139D8293618D8452AA2449B8CE88429D5F9B27E51E40476CF6B266E91FD1E63DB8EF4F96A608ABC02A08C04783AF63407CD4
Path      : C:\Users\xxx

So maybe I'm using the vcpkg_from_gitlab badly (and I'm getting a sign in page instead of the archive every time)?

vcpkg_from_gitlab(
    OUT_SOURCE_PATH SOURCE_PATH
    GITLAB_URL https://gitlab.company
    REPO repo
    REF v0.0.2
    HEAD_REF master
    SHA512 "0"
    AUTHORIZATION_TOKEN TOKEN
    FILE_DISAMBIGUATOR v0.0.2
)

[Osyotr]

You can run vcpkg with --debug flag to see how it runs curl.

[cacharle]

--debug doesn't show the curl command for me, just the Downloading ... I already saw before

[cacharle]

Turns out I already fixed the problem when I figured the correct permissions for the gitlab token.

But I still had some of the previous archives that were being reused, it worked after removing them from vcpkg/downloads

[dg0yt]

But I still had some of the previous archives that were being reused, it worked after removing them from vcpkg/downloads

Interesting point. IIRC another vcpkg_from_... function downloads to a different filename on SHA512 mismatch. Maybe vcpkg_from_gitlab lacks this convenience/robustness.