Bug#846609: apt: "Hash Sum mismatch" behind proxy

[Christian Kreidl <debian@chk.cksf.de>]

Package: apt
Version: 1.4~beta1
Severity: normal

Dear Maintainer,

"Hash Sum mismatch" errors occur on random files when apt is downloading packages from
snapshot.debian.org using a proxy.

I've tried apt-cacher-ng (0.8.0-3) and squid-deb-proxy (0.8.9; squid3: 3.4.8-6+deb8u3) as proxies
(on jessie machine) with same results. Also upgraded apt to latest version 1.4~beta1 from unstable,
but the error still persists.
Using the proxy from machines running Debian stable downloading packages from
http://ftp-stud.hs-esslingen.de works fine.

Setting the following options doesn't fix the errors:
Acquire::http::Pipeline-Depth "0";
Acquire::http::No-Cache "true";

Attached is the output of the command
apt -y -o Debug::pkgAcquire::Worker=1 -o Debug::Acquire::http=1 full-upgrade 2>&1
with the above options applied. The proxy cache was cleared before running the command.

Unpacking the files /var/cache/apt/archives/partial/*.FAILED show error
"dpkg-deb (subprocess): decompressing archive member: lzma error: unexpected end of input", but some
files could be extracted.
The package name and version in DEBIAN/control matches the name and version given in the  .deb
filename. So at least the right files are downloaded and not mixed up as in bug 832113.

Downloading works fine without proxy.

Proxy support should work with pipelining enabled and No-Cache disabled to speed up package downloading.

Thanks!

Christian

-- Package-specific info:

-- (no /etc/apt/preferences present) --


-- (no /etc/apt/preferences.d/* present) --


-- (/etc/apt/sources.list present, but not submitted) --


-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.4.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages apt depends on:
ii  adduser                 3.114
ii  debian-archive-keyring  2014.3
ii  gpgv                    1.4.20-5
ii  init-system-helpers     1.29
ii  libapt-pkg5.0           1.4~beta1
ii  libc6                   2.22-5
ii  libgcc1                 1:5.3.1-13
ii  libstdc++6              5.3.1-13

Versions of packages apt recommends:
ii  gnupg   1.4.20-5
ii  gnupg2  2.1.11-6

Versions of packages apt suggests:
pn  apt-doc         <none>
ii  aptitude        0.7.5-3
ii  dpkg-dev        1.18.4
ii  powermgmt-base  1.31+nmu1
pn  python-apt      <none>

-- no debconf information