[Pkg-utopia-maintainers] Identical filename, different checksums

[Jordan Webb]

I am using reprepro to maintain a local Debian mirror.  I am pulling from the squeeze, squeeze-updates, and squeeze security updates repos and merging it all down to one local repo named squeeze.

I am running into problems because it appears that there are two different files out there with the same name:

http://ftp.us.debian.org/debian/pool/main/p/policykit-1/policykit-1_0.96.orig.tar.gz
http://security.debian.org/pool/updates/main/p/policykit-1/policykit-1_0.96.orig.tar.gz

These files have different sizes and checksums, and cannot co-exist in the same pool.

I'm not sure if this is a problem with my usage of reprepro, or if this a mistake on the part of the policykit maintainers.  Is it valid for me to merge updates into the distribution like that and expect it to work?  Is the uniqueness of the file name in the pool only valid across each individual APT repository, or should I be able to rely on it across all of a particular release's repositories?  Was it intended that the file on ftp.us.debian.org differ from the one on security.debian.org, or is that a problem?  

I have not encountered this problem with any other packages, which leads me to think that it is perhaps a mistake, but it's possible I've just been lucky so far.  Any light you could shed on the situation would be greatly appreciated.

--
Jordan