Coreutils problem with sha1sum and other digests

rahrah · 03-24-2023, 05:33 PM

Hi,

I've just been hit by a bug in md5sum/sha1sum from coreutils-9.2.

Essentially, in certain circumstances, a digest manifest, when checked against a changed file, will print OK. The utility still reports an error at the end of the run, but in big manifests, it's a pain finding the failing file.

Here's a trivial script showing the problem:

Code:

#!/bin/bash

TMPFS_DIR=$(mktemp -d --suffix=-coreutils-prob --tmpdir=$(/bin/pwd))
cd "$TMPFS_DIR"
echo "aaaa" > a.txt
echo "bbbb" > b.txt
sha1sum *.txt > sha1s.txt
sha1sum -c sha1s.txt 
echo "cccc" > b.txt
echo "After file change in b.txt"
sha1sum -c sha1s.txt

With output:

Code:

$ sh sha1bad.sh 
a.txt: OK
b.txt: OK
After file change in b.txt
a.txt: OK
b.txt: OK
sha1sum: WARNING: 1 computed checksum did NOT match

It seems this has already been fixed in:

git://git.sv.gnu.org/coreutils
commit: 76f2fb627118a26c25003dbd98c22c153b7ee1d2

but it's not been part of a release tag.

Apologies if this has already been reported.

===Rich

GazL · 03-24-2023, 05:56 PM

Thanks for the heads up.

Applied to coreutils-9.2 on my CRUX box and "FAILED" is showing up again.

hpfeil · 03-24-2023, 05:58 PM

`Sha1sum -c FILE` reads the checksums contained in FILE, then calculates the sums and compares the results with FILE. Seems to be working as advertised. From man sha1sum: --check "read checksums from the FILEs and check them"

"b.txt: OK" simply mans it parsed that line in FILE with no errors during the read phase. Then it moves on to the check phase and finds the discrepancy. It does not tell you whether it was a.txt or b.txt which contained the error.

rahrah · 03-24-2023, 07:29 PM

Quote:

Originally Posted by GazL

Thanks for the heads up.

Applied to coreutils-9.2 on my CRUX box and "FAILED" is showing up again.

The patch from git seems to work on Slackware, too. Thanks for the feedback.

===Rich