[Resolved] Error installing boost Verification checksum was incorrect.

[cipolleschi]

9 Jan

Yesterday, the release crew released three versions of React Native:

• 0.73.2
• 0.72.9
• 0.71.15

Please, update your React Native apps to these version to avoid similar issues in the future.
We consider the boost verification issue gone.

Meanwhile, the original JFrog url is working again, so older version of React Native should be working as before the breakage.

Anyway, please try to allocate some time to migrate your app to a supported version.

8 Jan

What's happening

React Native uses a 3rd parties dependencies called boost which is a C++ utility library.
The library is hosted by JFrog and it is downloaded by the React Native's iOS build system when a user runs bundle exec pod install.
The download is then verified by checking the checksum of the downloaded tarball.

Starting from New Year's Eve, JFrog is having some troubles.
We had a first occurrence of the issue around New Year's Eve.
Over the weekend of the 6th of January, the issue represented itself.

The net effect of it is that iOS builds are failing when users run bundle exec pod install.

Mitigation

The mitigation we found is to move away from the JFrog ditribution, over the boost archives one.
This might not be the final solution, as we are waiting for an official answer from boost about what's the best source to use to download the library.
However, moving to the boost archive download url will unblock all the builds.

We already prepared various PRs for the various versions to address the issue:

• main: Migrate boost download away from JFrog #42118
• 0.73: [0.73][RN][General] Migrate boost download url away from JFrog #42176
• 0.72: [Local][RN][General] 0.72 - migrate boost away from JFrog #42175
• 0.71: [0.71][RN][General] Migrate boost download url away from JFrog #42177
• 0.70: [0.70][RN][General] Migrate boost download url away from JFrog #42178

It will require a little bit of time for the Release Crew to take care of all the versions, so bear with us and thanks for your patience.
Notice also that 0.70 is technically out of the support window. We might or might not release a new version of it, we still need to assess the impact on that version.

While the Release Crew is working on the releases, you can unblock yourself with the following workaround.

Workaround

While we are releasing new versions of React Native to mitigate the issue, you can unblock yourself by applying these patches to the react-native package.

Caveats:

• you don't have to update anything related to Android as we are shipping prebuilds for React Native, thus you don't need to download boost if you are building android.
• the patch needs to be applied after every yarn install as it modifies the node_modules. If you are using a tool like patch-packages, you shouldn't worry about this point.

0.73

diff --git a/node_modules/react-native/third-party-podspecs/boost.podspec b/node_modules/react-native/third-party-podspecs/boost.podspec
index 3950fce..3ae78ba 100644
--- a/node_modules/react-native/third-party-podspecs/boost.podspec
+++ b/node_modules/react-native/third-party-podspecs/boost.podspec
@@ -10,7 +10,7 @@ Pod::Spec.new do |spec|
   spec.homepage = 'http://www.boost.org'
   spec.summary = 'Boost provides free peer-reviewed portable C++ source libraries.'
   spec.authors = 'Rene Rivera'
-  spec.source = { :http => 'https://boostorg.jfrog.io/artifactory/main/release/1.83.0/source/boost_1_83_0.tar.bz2',
+  spec.source = { :http => 'https://archives.boost.io/release/1.83.0/source/boost_1_83_0.tar.bz2',
                   :sha256 => '6478edfe2f3305127cffe8caf73ea0176c53769f4bf1585be237eb30798c3b8e' }
 
   # Pinning to the same version as React.podspec.

0.72

diff --git a/node_modules/react-native/third-party-podspecs/boost.podspec b/node_modules/react-native/third-party-podspecs/boost.podspec
index 3950fce..3ae78ba 100644
--- a/node_modules/react-native/third-party-podspecs/boost.podspec
+++ b/node_modules/react-native/third-party-podspecs/boost.podspec
@@ -10,7 +10,7 @@ Pod::Spec.new do |spec|
   spec.homepage = 'http://www.boost.org'
   spec.summary = 'Boost provides free peer-reviewed portable C++ source libraries.'
   spec.authors = 'Rene Rivera'
-  spec.source = { :http => 'https://boostorg.jfrog.io/artifactory/main/release/1.76.0/source/boost_1_76_0.tar.bz2',
+  spec.source = { :http => 'https://archives.boost.io/release/1.76.0/source/boost_1_76_0.tar.bz2',
                   :sha256 => 'f0397ba6e982c4450f27bf32a2a83292aba035b827a5623a14636ea583318c41' }
 
   # Pinning to the same version as React.podspec.

0.71

diff --git a/node_modules/react-native/third-party-podspecs/boost.podspec b/node_modules/react-native/third-party-podspecs/boost.podspec
index 3950fce..3ae78ba 100644
--- a/node_modules/react-native/third-party-podspecs/boost.podspec
+++ b/node_modules/react-native/third-party-podspecs/boost.podspec
@@ -10,7 +10,7 @@ Pod::Spec.new do |spec|
   spec.homepage = 'http://www.boost.org'
   spec.summary = 'Boost provides free peer-reviewed portable C++ source libraries.'
   spec.authors = 'Rene Rivera'
-  spec.source = { :http => 'https://boostorg.jfrog.io/artifactory/main/release/1.76.0/source/boost_1_76_0.tar.bz2',
+  spec.source = { :http => 'https://archives.boost.io/release/1.76.0/source/boost_1_76_0.tar.bz2',
                   :sha256 => 'f0397ba6e982c4450f27bf32a2a83292aba035b827a5623a14636ea583318c41' }
 
   # Pinning to the same version as React.podspec.

0.70

diff --git a/node_modules/react-native/third-party-podspecs/boost.podspec b/node_modules/react-native/third-party-podspecs/boost.podspec
index 3950fce..3ae78ba 100644
--- a/node_modules/react-native/third-party-podspecs/boost.podspec
+++ b/node_modules/react-native/third-party-podspecs/boost.podspec
@@ -10,7 +10,7 @@ Pod::Spec.new do |spec|
   spec.homepage = 'http://www.boost.org'
   spec.summary = 'Boost provides free peer-reviewed portable C++ source libraries.'
   spec.authors = 'Rene Rivera'
-  spec.source = { :http => 'https://boostorg.jfrog.io/artifactory/main/release/1.76.0/source/boost_1_76_0.tar.bz2',
+  spec.source = { :http => 'https://archives.boost.io/release/1.76.0/source/boost_1_76_0.tar.bz2',
                   :sha256 => 'f0397ba6e982c4450f27bf32a2a83292aba035b827a5623a14636ea583318c41' }
 
   # Pinning to the same version as React.podspec.

Steps to reproduce

create a new react native app
run bundle exec pod install
observe the issue

React Native Version

All the React Native versions

[cortinico]

Hey all,
Just a small heads up that as of now, the JFrog's Boost Mirror is back up, so operations should be back to normal.