Checksum validation fails for faraday_middleware-0.11.0.gem

[kdykeman]

Issue

When running bundle install the following disconcerting message comes up:

Bundler cannot continue installing faraday_middleware (0.11.0).
The checksum for the downloaded faraday_middleware-0.11.0.gem does not match
the checksum given by the server. This means the contents of the downloaded gem
is different from what was uploaded to the server, and could be a potential
security issue.

Context

See rubygems/bundler#5332

Steps to Reproduce

Run bundle install

Expected result

Bundler doesn't complain about the checksums not matching.

Current result

Bundler complains about the checksums not matching (see screenshot)

Possible Fix

Update to a newer version of faraday_middleware where the community asserts the checksums match.

name of issue screenshot

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/141183785

The labels on this github issue will be updated when the story is started.

[mikexuu]

Hey @kdykeman ,

Thanks for submitting this issue. It does look like this is a known faraday_middleware / rubygems issue. However, we are only pulling in this gem because of fog-azure-rm, and it feels a bit weird to have this explicitly specified in our Gemfile. I would suggest submitting an issue / PR to fog-azure-rm to get this fix (and sometime in the future we can bump our fog-azure-rm version). For the short term, I would suggest to just downgrade your bundler to a version before they started validating checksums. Closing this issue for now, feel free to reopen if you have any concerns.

Thanks,
CAPI Community, @michaelxupiv

[zrob]

A link for more information: rubygems/bundler#5332

[Gerg]

Relevant issues:

• Mismatched checksums on a couple gems rubygems/rubygems.org#1551
• Checksum failing for faraday_middleware 0.11.0 and bundler 1.14.0.pre.x rubygems/bundler#5332
• Version 0.1.6 on rubygems with invalid SHA 256 Azure/azure-ruby-asm-core#32
• Checksum for 0.11.0 on rubygems.org is invalid lostisland/faraday_middleware#152

[zrob]

The linked issues seem to indicate that azure gem has been updated and we can bump it to get the updated version of faraday_middleware. Reopening until we rule out bumping the dependency.

[kdykeman]

Thanks @zrob, I spotted that today as well when looking upstream.

[Gerg]

The chain is:
cloudfoundry/cloud_controller_ng > fog/fog-azure-rm > Azure/azure-storage-ruby > Azure/azure-ruby-asm-core (checksum issue) > lostisland/faraday_middleware (checksum issue)

[zrob]

@kdykeman a fix should be available on master now. Would mind verifying that you are able to bundle?

thanks!

[kdykeman]

@zrob Thanks! I am now able to bundle.