Public bug reported: apt uses its own strategy for sending Range: requests on https, instead of the libcurl handling. Here's is a scenario where it gets it wrong:
1) apt downloads the file but doesn't put the file in place yet (perhaps it got interrupted or something) 2) the file on the server gets replaced by a smaller file 3) the next update run wants to download the file, sees a partial read, and asks for Range: (len(file)-1)- 4) the server sees a Range: request for a byte-range past the end of (the current version of) the file, considers it invalid, and streams the entire file. (This is correct behavior.) 5) apt assumes the response is the range it expected, and appends it to the local staging copy (minus one byte). Instead of rolling apt's own attempt to handle ranges in the https method, it should just use libcurl's. Attached is a patch which solves the problem. ** Affects: apt (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1157943 Title: apt-get update fails hash checks on https repositories when file size changes To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1157943/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs