Repository navigation
[Bug]: outdated savannah URL in subprojects/freetype-2.6.1.wrap #31340
Description
Bug summary
When building from source of matplotlib v3.10.8 downloaded from PyPi, the following message is observed
Downloading freetype-2.6.1 source from https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz
HTTP Error 502: Bad Gateway
WARNING: failed to download with error: could not get https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz; is the internet available?. Trying after a delay...
HTTP Error 502: Bad Gateway
This is because there is an outdated URL in subprojects/freetype-2.6.1.wrap
The line in freetype-2.6.1.wrap should be changed from
source_url = https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz
to
source_url=https://download.savannah.nongnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz
To show that this updated URL works, here is the output from wget.
Please note that downloads from savannah get redirected to a third party site, so that should raise security concerns.
wget https://download.savannah.nongnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz
--2026-03-20 18:10:33-- https://download.savannah.nongnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz
Resolving download.savannah.nongnu.org... 2001:470:142:5::200, 209.51.188.200
Connecting to download.savannah.nongnu.org|2001:470:142:5::200|:443... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: https://fosszone.csd.auth.gr/nongnu/freetype/freetype-old/freetype-2.6.1.tar.gz [following]
--2026-03-20 18:10:36-- https://fosszone.csd.auth.gr/nongnu/freetype/freetype-old/freetype-2.6.1.tar.gz
Resolving fosszone.csd.auth.gr... 155.207.200.222
Connecting to fosszone.csd.auth.gr|155.207.200.222|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2302080 (2.2M) [application/x-gzip]
Saving to: ‘freetype-2.6.1.tar.gz.1’
freetype-2.6.1.tar.gz.1 100%[====================================================================================================>] 2.20M 5.57MB/s in 0.4s
2026-03-20 18:10:37 (5.57 MB/s) - ‘freetype-2.6.1.tar.gz.1’ saved [2302080/2302080]
Code for reproduction
/usr/local/bin/pip3.12 install /usr/src/build/matplotlib-3.10.8/ --no-binary all --no-build-isolation --no-cache-dir --no-deps --no-index --no-warn-script-location --progress-bar off --root "/usr/local/stow/Languages/Python_312/matplotlib_312-3.10.8" --verboseActual outcome
Downloading freetype-2.6.1 source from https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz
HTTP Error 502: Bad Gateway
Expected outcome
The file freetype-2.6.1.tar.gz should be downloaded.
Additional information
No response
Operating system
No response
Matplotlib Version
3.10.8
Matplotlib Backend
No response
Python version
Python 3.12
Jupyter version
No response
Installation
from source (.tar.gz)
Activity
ShubhamS2005 commentedon Mar 20, 2026
Hi! I was able to reproduce and analyze the issue.
The current freetype source URL can intermittently return HTTP 502 errors, as mentioned. While it may occasionally work depending on the mirror, it is not consistently reliable.
The alternative URL (savannah.nongnu.org) works correctly and provides a more stable download source.
I’d like to fix this by updating the source_url in the wrap file. Please let me know if this approach looks good.
ShubhamS2005 commentedon Mar 20, 2026
Hi, I’ve submitted a PR to fix this issue: #31341
Please let me know if any changes are required. Thanks!
Donj63000 commentedon Mar 20, 2026
HII ! I think the reliability issue is real, but I don’t think the root cause is that
download.savannah.gnu.orgis simply “outdated”.Savannah documents
download.savannah.{gnu,nongnu}.orgas the same public-facing redirector for the Savannah download area, and recommendsdownload-mirror.savannah.gnu.org/releases/when a download without redirections is desired. Since that redirector picks a mirror, changing.gnu.orgto.nongnu.orgmay work in practice only because it lands on a different mirror, but it does not remove the fragile redirect layer.So the more robust fix seems to be changing the primary URL to:
while keeping the existing
source_fallback_urlto SourceForge and the currentsource_hash.The tarball is present at that Savannah path, so this should be a minimal change that avoids the extra redirect hop.
Also, I would slightly reframe the security concern: mirror redirection is not ideal for availability/privacy, but it is not really an integrity problem here because Meson verifies
source_hashbefore unpacking.As immediate workarounds, Matplotlib already documents either building against a system FreeType (
-Dsystem-freetype=true) or pre-seedingsubprojects/packagecache/MESON_PACKAGE_CACHE_DIRwith the tarball.If that sounds reasonable, I can open a small PR for the
download-mirrorchange!ShubhamS2005 commentedon Mar 20, 2026
Thanks for the detailed explanation — that makes sense.
I agree that switching to
download-mirror.savannah.gnu.orgis a cleaner approach than changing to.nongnu.org, since it avoids the redirect layer while still aligning with Savannah’s recommended usage.I’ll update the patch to:
download-mirror.savannah.gnu.orgURLI’ll push an update shortly. Please let me know if there’s anything else I should adjust.
ShubhamS2005 commentedon Mar 20, 2026
Updated the URL to use download-mirror.savannah.gnu.org as suggested.
scottshambaugh commentedon Mar 25, 2026
As discussed in #31287, any changes to downloaded source code URLs needs to be supported by external documentation showing that URL as an official mirror.
Fix: update outdated savannah URL from gnu.org to nongnu.org