Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The format of the release checksum does not comply with the standard #3480

Closed
smuu opened this issue Apr 11, 2023 · 0 comments · Fixed by #3481
Closed

The format of the release checksum does not comply with the standard #3480

smuu opened this issue Apr 11, 2023 · 0 comments · Fixed by #3481
Labels
type:error Something isn't working

Comments

@smuu
Copy link
Contributor

smuu commented Apr 11, 2023

Describe the bug
Checking the release_checksum on alpine-based images fails.
The --release parameter in the build command creates a release_checksum file. The content looks like the following <sha256sum><space><file_name>. See here in the code.
From the sha256sum man page: See here.

The sums are computed as described in FIPS-180-2. When checking, the input should be a former output of this program. The default mode is to print a line with checksum, a character indicating type ('*' for binary, ' ' for text), and name for each FILE.

So, in this case, the content of the checksum file should be <sha256sum><space><space><file_name>.
Alpine is very strict when it comes to checking the format of checksums. Debian-based images tolerate this, so it does not fail there.
To reproduce
Steps to reproduce the behavior:

  1. Download example releases and checksum file
wget https://github.com/ignite/example/releases/download/latest/release_checksum
wget https://github.com/ignite/example/releases/download/latest/example_latest_darwin_amd64.tar.gz
wget https://github.com/ignite/example/releases/download/latest/example_latest_darwin_arm64.tar.gz
wget https://github.com/ignite/example/releases/download/latest/example_latest_linux_amd64.tar.gz
  1. Start an Alpine container and mount the files
docker run -it -w /work -v ./:/work alpine
  1. Run the checksum check and see that it fails
cat release_checksum | sha256sum -c -w -

Output:

sha256sum: invalid format
sha256sum: invalid format
sha256sum: invalid format
sha256sum: WARNING: 3 of 3 computed checksums did NOT match

As a reference, this is how it looks for Debian-based images:

cat release_checksum | sha256sum -c -w -

Output:

example_latest_darwin_amd64.tar.gz: OK
example_latest_darwin_arm64.tar.gz: OK
example_latest_linux_amd64.tar.gz: OK

What version are you using?
All versions, code was not changed since it was introduced.

@smuu smuu added the type:error Something isn't working label Apr 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:error Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant