Subject: bug#62403: closed (Re: bug#62403: checksums --check (sha256sum, sha1sum) return file: OK when they shouldn't)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 23 Mar 2023 12:44:01 +0000

Your bug report

#62403: checksums --check (sha256sum, sha1sum) return file: OK when they shouldn't

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
62403: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=62403
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#62403: checksums --check (sha256sum, sha1sum) return file: OK when they shouldn't
From: Pádraig Brady <[email-masked]>
To: Moviuro <[email-masked]>, [email-masked]
Date: Thu, 23 Mar 2023 12:43:04 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

On 23/03/2023 09:32, Moviuro via GNU coreutils Bug Reports wrote:
> Hello,
> 
> This report was first found on r/archlinux:
> 
> % echo "123" > 1
> % echo "1234" > 2
> % echo "abc" > 3
> % sha256sum 1 2 3 > sums.sha256
> % sha1sum 1 2 3 > sums.sha1
> % echo "123" > 2 # break file 2
> 
> % sha256sum -c sums.sha256 # returns 2: OK (incorrect)
> % sha1sum -c sums.sha1 # returns 2: OK
> 
> % tail -n 2 sums.sha256 | sha256sum -c # returns 2: FAILED (correct)
> % tail -n 2 sums.sha1 | sha1sum -c # returns 2: FAILED
> 
> See https://redd.it/11zdecf .
> 
> Someone pointed at this commit, though I'm unable to confirm that:
> https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b319685c6e12e66bf357c2384fe69f1c63f66aed
> 
> % sha256sum --version
> sha256sum (GNU coreutils) 9.2

The attached should fix this.
Sorry for the trouble.
Note the exit status is still OK, and so automated scripts would be unaffected,
but yes reporting the status incorrectly here to the user is a bad bug.

Marking this as done.

thanks,
Pádraig

From 76f2fb627118a26c25003dbd98c22c153b7ee1d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <[email-masked]>
Date: Thu, 23 Mar 2023 12:31:24 +0000
Subject: [PATCH] cksum: fix reporting of failed checks

This applies to all checksumming utilities,
where we incorrectly report all subsequent files as checking 'OK'
once any file has passed a digest check.
The exit status was not impacted, only the printed status.

* src/digest.c (digest_check): Use the correct state variable
to determine if the _current_ file has passed or not.
* tests/misc/md5sum.pl: Add a test case.
Fixes https://bugs.gnu.org/62403
---
 src/digest.c         |  4 ++--
 tests/misc/md5sum.pl | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/digest.c b/src/digest.c
index 6ee8a4854..ab32968db 100644
--- a/src/digest.c
+++ b/src/digest.c
@@ -1254,14 +1254,14 @@ digest_check (char const *checkfile_name)
 
               if (!status_only)
                 {
-                  if ( ! matched_checksums || ! quiet)
+                  if (! match || ! quiet)
                     {
                       if (needs_escape)
                         putchar ('\\');
                       print_filename (filename, needs_escape);
                     }
 
-                  if ( ! matched_checksums)
+                  if (! match)
                     printf (": %s\n", _("FAILED"));
                   else if (!quiet)
                     printf (": %s\n", _("OK"));
diff --git a/tests/misc/md5sum.pl b/tests/misc/md5sum.pl
index 186aca977..d712664b2 100755
--- a/tests/misc/md5sum.pl
+++ b/tests/misc/md5sum.pl
@@ -101,6 +101,16 @@ my @Tests =
                   . "md5sum: WARNING: 1 line is improperly formatted\n"
                   . "md5sum: WARNING: 2 computed checksums did NOT match\n"},
                                 {EXIT=> 1}],
+     # Ensure we use appropriate state to track failures (broken in 9.2)
+     ['check-multifail-state', '--check', '--warn',
+                                {IN=>{'f.md5' =>
+                                      "$degenerate  f\n"
+                                      . "$degenerate  g\n"
+                                      . "$degenerate  f\n" }},
+                                {AUX=> {f=> ''}}, {AUX=> {g=> 'a'}},
+                                {OUT=>"f: OK\ng: FAILED\nf: OK\n"},
+              {ERR=>"md5sum: WARNING: 1 computed checksum did NOT match\n"},
+                                {EXIT=> 1}],
      # The sha1sum and md5sum drivers share a lot of code.
      # Ensure that md5sum does *not* share the part that makes
      # sha1sum accept BSD format.
-- 
2.26.2

Subject: checksums --check (sha256sum, sha1sum) return file: OK when they shouldn't
From: Moviuro <[email-masked]>
To: [email-masked]
Date: Thu, 23 Mar 2023 10:32:53 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

This report was first found on r/archlinux:

% echo "123" > 1
% echo "1234" > 2
% echo "abc" > 3
% sha256sum 1 2 3 > sums.sha256
% sha1sum 1 2 3 > sums.sha1
% echo "123" > 2 # break file 2

% sha256sum -c sums.sha256 # returns 2: OK (incorrect)
% sha1sum -c sums.sha1 # returns 2: OK

% tail -n 2 sums.sha256 | sha256sum -c # returns 2: FAILED (correct)
% tail -n 2 sums.sha1 | sha1sum -c # returns 2: FAILED

See https://redd.it/11zdecf .

Someone pointed at this commit, though I'm unable to confirm that:
https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b319685c6e12e66bf357c2384fe69f1c63f66aed

% sha256sum --version
sha256sum (GNU coreutils) 9.2
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ulrich Drepper, Scott Miller, and David Madore.

Best regards,