Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256124 > unrolled thread

bookworm sha256sum may be defective

Back to article view | Back to linux.debian.user

Contents

  bookworm sha256sum may be defective Jude DaShiell <jdashiel@panix.com> - 2023-03-17 14:40 +0100
    Re: bookworm sha256sum may be defective Tom Furie <tom@furie.org.uk> - 2023-03-17 15:00 +0100
    Re: bookworm sha256sum may be defective "Thomas Schmitt" <scdbackup@gmx.net> - 2023-03-17 15:00 +0100
      Re: bookworm sha256sum may be defective Jude DaShiell <jdashiel@panix.com> - 2023-03-17 15:40 +0100
        Re: bookworm sha256sum may be defective "Thomas Schmitt" <scdbackup@gmx.net> - 2023-03-17 16:30 +0100
          Re: bookworm sha256sum may be defective Jude DaShiell <jdashiel@panix.com> - 2023-03-17 17:10 +0100
          Re: bookworm sha256sum may be defective Nicolas George <george@nsup.org> - 2023-04-24 13:40 +0200
    Re: bookworm sha256sum may be defective Jeffrey Walton <noloader@gmail.com> - 2023-03-17 15:10 +0100
      Re: bookworm sha256sum may be defective Jude DaShiell <jdashiel@panix.com> - 2023-03-17 15:30 +0100
    Re: bookworm sha256sum may be defective davidson <davidson@freevolt.org> - 2023-03-17 15:50 +0100
      Re: bookworm sha256sum may be defective Jude DaShiell <jdashiel@panix.com> - 2023-03-17 16:10 +0100
        Re: bookworm sha256sum may be defective Dan Ritter <dsr@randomstring.org> - 2023-03-17 17:10 +0100
      Re: bookworm sha256sum may be defective davidson <davidson@freevolt.org> - 2023-03-17 16:10 +0100

#256124 — bookworm sha256sum may be defective

I have had multiple verification failures checking an iso with a sha256sum
verification file and am wondering if that program and the rest of the
shaxxxsum programs have one or more bugs that could account for these
failures.



Jude <jdashiel at panix dot com> "There are four boxes to be used in
defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)

.

[toc] | [next] | [standalone]

#256126

[Multipart message — attachments visible in raw view] — view raw

On Fri, Mar 17, 2023 at 09:36:07AM -0400, Jude DaShiell wrote:
> I have had multiple verification failures checking an iso with a sha256sum
> verification file and am wondering if that program and the rest of the
> shaxxxsum programs have one or more bugs that could account for these
> failures.

Which iso, from where?

Cheers,
Tom

-- 
I'm very old-fashioned.  I believe that people should marry for life,
like pigeons and Catholics.
		-- Woody Allen

[toc] | [prev] | [next] | [standalone]

#256127

Hi,

Jude DaShiell wrote:
> I have had multiple verification failures checking an iso with a sha256sum
> verification file and am wondering if that program and the rest of the
> shaxxxsum programs have one or more bugs that could account for these
> failures.

That would be quite surprising, given how much these programs are used.

Is the ISO and the sha256sum file still available for download ?
Are there other checksum files (MD5, SHA512) for that ISO ?


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#256131

Yes they're available and no no other checksum files are available.
https://slackware.uk/slint/x86_64/slint-15.0/iso/slint64-15.0-2.iso.sha256
https://slackware.uk/slint/x86_64/slint-15.0/iso/slint64-15.0-2.iso


Jude <jdashiel at panix dot com>
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)

.

On Fri, 17 Mar 2023, Thomas Schmitt wrote:

> Hi,
>
> Jude DaShiell wrote:
> > I have had multiple verification failures checking an iso with a sha256sum
> > verification file and am wondering if that program and the rest of the
> > shaxxxsum programs have one or more bugs that could account for these
> > failures.
>
> That would be quite surprising, given how much these programs are used.
>
> Is the ISO and the sha256sum file still available for download ?
> Are there other checksum files (MD5, SHA512) for that ISO ?
>
>
> Have a nice day :)
>
> Thomas
>
>

[toc] | [prev] | [next] | [standalone]

#256138

Hi,

Jude DaShiell wrote:
> https://slackware.uk/slint/x86_64/slint-15.0/iso/slint64-15.0-2.iso.sha256
> https://slackware.uk/slint/x86_64/slint-15.0/iso/slint64-15.0-2.iso

Let's see what an older Debian perceives (... downloading 3.7 GiB lasts a
while ...):

  $ sha256sum -c slint64-15.0-2.iso.sha256
  slint64-15.0-2.iso: OK

Various checksums:

  $ sha256sum slint64-15.0-2.iso
  cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3  slint64-15.0-2.iso
  $ sha512sum slint64-15.0-2.iso
  faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4  slint64-15.0-2.iso
  $ md5sum slint64-15.0-2.iso
  f00a3d3bf641309feac4b1aa9abacf4f  slint64-15.0-2.iso
  $ crc32 slint64-15.0-2.iso
  3ed8c08a
  $

I don't think that somebody fiddled with pickles like md5sum or crc32.
So only if sha256sum says mismatch and md5sum says match, then i would
suspect that sha256sum is broken.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#256139

Thanks for checking this for me, apparently I've got hardware problems.



Jude <jdashiel at panix dot com> "There are four boxes to be used in
defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)

.

On Fri, 17 Mar 2023, Thomas Schmitt wrote:

> Hi,
>
> Jude DaShiell wrote:
> > https://slackware.uk/slint/x86_64/slint-15.0/iso/slint64-15.0-2.iso.sha256
> > https://slackware.uk/slint/x86_64/slint-15.0/iso/slint64-15.0-2.iso
>
> Let's see what an older Debian perceives (... downloading 3.7 GiB lasts a
> while ...):
>
>   $ sha256sum -c slint64-15.0-2.iso.sha256
>   slint64-15.0-2.iso: OK
>
> Various checksums:
>
>   $ sha256sum slint64-15.0-2.iso
>   cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3  slint64-15.0-2.iso
>   $ sha512sum slint64-15.0-2.iso
>   faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4  slint64-15.0-2.iso
>   $ md5sum slint64-15.0-2.iso
>   f00a3d3bf641309feac4b1aa9abacf4f  slint64-15.0-2.iso
>   $ crc32 slint64-15.0-2.iso
>   3ed8c08a
>   $
>
> I don't think that somebody fiddled with pickles like md5sum or crc32.
> So only if sha256sum says mismatch and md5sum says match, then i would
> suspect that sha256sum is broken.
>
>
> Have a nice day :)
>
> Thomas
>
>

[toc] | [prev] | [next] | [standalone]

#257527

[Multipart message — attachments visible in raw view] — view raw

Thomas Schmitt (12023-03-17):
> Various checksums:
> 
>   $ sha256sum slint64-15.0-2.iso
>   cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3  slint64-15.0-2.iso
>   $ sha512sum slint64-15.0-2.iso
>   faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4  slint64-15.0-2.iso
>   $ md5sum slint64-15.0-2.iso
>   f00a3d3bf641309feac4b1aa9abacf4f  slint64-15.0-2.iso
>   $ crc32 slint64-15.0-2.iso
>   3ed8c08a
>   $

By the way, shameless plug:

~ $ time multihash tmp_debian_ml/slint64-15.0-2.iso
crc32:3ed8c08a  tmp_debian_ml/slint64-15.0-2.iso
md5:f00a3d3bf641309feac4b1aa9abacf4f  tmp_debian_ml/slint64-15.0-2.iso
sha1:d9c904d1d174366d495f4d8ac210437d5c8d7fa4  tmp_debian_ml/slint64-15.0-2.iso
sha256:cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3  tmp_debian_ml/slint64-15.0-2.iso
sha512:faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4  tmp_debian_ml/slint64-15.0-2.iso
multihash tmp_debian_ml/slint64-15.0-2.iso  49.04s user 1.30s system 346% cpu 14.531 total

~ $ time multihash tmp_debian_ml/slint64-15.0-2.iso
crc32:3ed8c08a  tmp_debian_ml/slint64-15.0-2.iso
md5:f00a3d3bf641309feac4b1aa9abacf4f  tmp_debian_ml/slint64-15.0-2.iso
sha1:d9c904d1d174366d495f4d8ac210437d5c8d7fa4  tmp_debian_ml/slint64-15.0-2.iso
sha256:cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3  tmp_debian_ml/slint64-15.0-2.iso
sha512:faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4  tmp_debian_ml/slint64-15.0-2.iso
multihash tmp_debian_ml/slint64-15.0-2.iso  0.00s user 0.00s system 39% cpu 0.009 total

~ $ time multihash -r tmp_debian_ml
{
   "files" : [
      {
         "path" : "/",
         "type" : "D",
         "mtime" : 1682336027,
         "mode" : "0755"
      },
      {
         "path" : "/slint64-15.0-2.iso",
         "type" : "F",
         "size" : 3991879680,
         "mtime" : 1676851591,
         "mode" : "0644",
         "hash" : {
            "crc32" : "3ed8c08a",
            "md5" : "f00a3d3bf641309feac4b1aa9abacf4f",
            "sha1" : "d9c904d1d174366d495f4d8ac210437d5c8d7fa4",
            "sha256" : "cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3",
            "sha512" : "faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4"
         }
      }
   ]
}
multihash -r tmp_debian_ml  0.00s user 0.00s system 32% cpu 0.013 total

~ $ tar -c tmp_debian_ml | multihash -t
{
   "files" : [
      {
         "path" : "tmp_debian_ml",
         "type" : "D",
         "mtime" : 1682336027,
         "mode" : "0755"
      },
      {
         "path" : "tmp_debian_ml/slint64-15.0-2.iso",
         "type" : "F",
         "size" : 3991879680,
         "mtime" : 1676851591,
         "mode" : "0644",
         "hash" : {
            "crc32" : "3ed8c08a",
            "md5" : "f00a3d3bf641309feac4b1aa9abacf4f",
            "sha1" : "d9c904d1d174366d495f4d8ac210437d5c8d7fa4",
            "sha256" : "cc0421fdd9630d3bb3ea8ef338c7cfb7a29fd8df98ccbae3debed60847a976a3",
            "sha512" : "faf3210c680caeb5875651989aeb2841b4a0733a618b8d13e5163ebf5c16046d82d4ee645d471664604eeb164e0bd7b919f64e4798167f48a6ed2e935d06d6a4"
         }
      }
   ]
}

https://github.com/Cigaes/multihash

Regards,

-- 
  Nicolas George

[toc] | [prev] | [next] | [standalone]

#256128

On Fri, Mar 17, 2023 at 9:36 AM Jude DaShiell <jdashiel@panix.com> wrote:
>
> I have had multiple verification failures checking an iso with a sha256sum
> verification file and am wondering if that program and the rest of the
> shaxxxsum programs have one or more bugs that could account for these
> failures.

That usually indicates the download was corrupted.

If you are working on a SDcard, then the media is going bad.

Jeff

[toc] | [prev] | [next] | [standalone]

#256129

If by sd card you mean solid state drive, thanks for letting me know.
Fortunately I had two of these drives installed in this computer so can
use the other one and replace the bad one.



Jude <jdashiel at panix dot com> "There are four boxes to be used in
defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)

.

On Fri, 17 Mar 2023, Jeffrey Walton wrote:

> On Fri, Mar 17, 2023 at 9:36?AM Jude DaShiell <jdashiel@panix.com> wrote:
> >
> > I have had multiple verification failures checking an iso with a sha256sum
> > verification file and am wondering if that program and the rest of the
> > shaxxxsum programs have one or more bugs that could account for these
> > failures.
>
> That usually indicates the download was corrupted.
>
> If you are working on a SDcard, then the media is going bad.
>
> Jeff
>
>

[toc] | [prev] | [next] | [standalone]

#256132

On Fri, 17 Mar 2023 Jude DaShiell wrote:
> I have had multiple verification failures checking an iso with a sha256sum
> verification file and am wondering if that program and the rest of the
> shaxxxsum programs have one or more bugs that could account for these
> failures.

Let the sha256sum program be a box of test strips that indicate
presence of poison.

Let the files you provide the sha256sum program be a beverage.

If a single test indicated poison, my first thought would not be,
"Maybe the test strips are defective".

And if *repeated* tests indicated poison, and did so consistently, my
first thought would not *definitely* not be, "Maybe the test strips
are defective".

It is admittedly an imperfectly simplified analogy, but I think my
point ought to be clear enough.

-- 
Ce qui est important est rarement urgent
et ce qui est urgent est rarement important
-- Dwight David Eisenhower

[toc] | [prev] | [next] | [standalone]

#256134

Another contact has done repeated testing on both local and remote
instances of these files and has no failures.  I'm suspecting the solid
state drive is going south.  Fortunately this computer came with two
internal so I'll start using the other drive from now on and hope I can
duplicate my contact's successful verifications.



Jude <jdashiel at panix dot com> "There are four boxes to be used in
defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author, 1940)

.

On Fri, 17 Mar 2023, davidson wrote:

> On Fri, 17 Mar 2023 davidson wrote:
> > On Fri, 17 Mar 2023 Jude DaShiell wrote:
> >> I have had multiple verification failures checking an iso with a sha256sum
> >> verification file and am wondering if that program and the rest of the
> >> shaxxxsum programs have one or more bugs that could account for these
> >> failures.
> >
> > Let the sha256sum program be a box of test strips that indicate
> > presence of poison.
> >
> > Let the files you provide the sha256sum program be a beverage.
> >
> > If a single test indicated poison, my first thought would not be,
> > "Maybe the test strips are defective".
>
> Typo below:
>
> > And if *repeated* tests indicated poison, and did so consistently, my
> > first thought would not *definitely* not be, "Maybe the test strips
> > are defective".
>
> s/not *definitely* not/*definitely* not/
>
> In other words, repeated consistent indications of poison would
> confirm my first reaction: the drink is most likely poisonous.
>
> One can imagine situations that would cause me to doubt the test
> strips, but the situation described by the OP is definitely not one of
> them.
>
>

[toc] | [prev] | [next] | [standalone]

#256141

Jude DaShiell wrote: 
> Another contact has done repeated testing on both local and remote
> instances of these files and has no failures.  I'm suspecting the solid
> state drive is going south.  Fortunately this computer came with two
> internal so I'll start using the other drive from now on and hope I can
> duplicate my contact's successful verifications.


I once discovered that a RAID controller was flaky when I was
running a series of md5sum hashes and found issues like this.

Sometimes it's the hardware. Check your logs for drive errors.

-dsr-

[toc] | [prev] | [next] | [standalone]

#256135

On Fri, 17 Mar 2023 davidson wrote:
> On Fri, 17 Mar 2023 Jude DaShiell wrote:
>> I have had multiple verification failures checking an iso with a sha256sum
>> verification file and am wondering if that program and the rest of the
>> shaxxxsum programs have one or more bugs that could account for these
>> failures.
>
> Let the sha256sum program be a box of test strips that indicate
> presence of poison.
>
> Let the files you provide the sha256sum program be a beverage.
>
> If a single test indicated poison, my first thought would not be,
> "Maybe the test strips are defective".

Typo below:

> And if *repeated* tests indicated poison, and did so consistently, my
> first thought would not *definitely* not be, "Maybe the test strips
> are defective".

s/not *definitely* not/*definitely* not/

In other words, repeated consistent indications of poison would
confirm my first reaction: the drink is most likely poisonous.

One can imagine situations that would cause me to doubt the test
strips, but the situation described by the OP is definitely not one of
them.

-- 
Ce qui est important est rarement urgent
et ce qui est urgent est rarement important
-- Dwight David Eisenhower

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web