Control: tags -1 patch
Patch against 1:3.2.4~rc1-3.5 for systems/Linux/2/deb_checkmd5sums (Linux/3
and Linux/4 are copies in the Debian source).
Three fixes in one file:
1. prelink is gone. As Francois Gouget showed in 2017, "prelink -y --md5
-c" is rejected by prelink, so the check reported nothing on any system
that had it installed. prelink is no longer in the archive and the original
reason for it (#445531) is gone, so md5sum -c is used unconditionally.
2. The output parsing. The loop read md5sum's output as "file status" but
the sed in front of it rewrote lines to "DIFF file", so the status was
taken for the file name, as Benjamin S. pointed out in 2009. Current md5sum
prints "file: FAILED open or read" for a missing file, which nothing
matched, and the grep that should then confirm the file belongs to the
package had literal quotes around the name. Missing package files were
therefore never reported. The output is now read as "STATUS file" (which
also keeps file names with spaces intact), the current messages are
recognised, and a file is only called missing when it does not exist.
3. The /usr/share exclusion used a bracket expression, [doc|help|...],
which matches a single character, so documentation, man pages and locales
were hashed too. It is an alternation now, with fonts added as the 2018
changelog intended.
Verified in debian:sid, debian:stable and ubuntu:24.04 containers with one
packaged binary modified and one deleted: both are reported now (lin005f
and lin006f); before, the deleted one was missed. On a Linux Mint 22.3
desktop the check finishes in 41 s and reports the same 11 modified files
as dpkg --verify.
Andrei Trimbitas
--- a/systems/Linux/2/deb_checkmd5sums
+++ b/systems/Linux/2/deb_checkmd5sums
@@ -17,6 +17,16 @@
#
# Linux/deb_checkmd5sums - 24/08/2001
#
+# 10/04/2026 - atrimbitas - Read md5sum's output as 'STATUS file' so file
names
+# with spaces work and FAILED is no longer taken for the file name
+# (Benjamin S. in Debian bug #505906). Recognise current md5sum
+# output, so missing files are reported again, and quote the file
+# name in that grep. Exclude the /usr/share directories with an
+# alternation: the bracket expression only ever matched one letter.
+# 10/04/2026 - atrimbitas - Stop using prelink to compute checksums. It was
+# called with options it does not accept, so the check reported
+# nothing on systems that had it installed, and prelink is no longer
+# shipped (Debian bug #505906, Savannah bug #52087)
# 01/23/2014 - jfs - Fix the location of dpkg-divert (Debian bug #732936
and #735102)
# 12/19/2013 - jfs - Do not use dpkg-divert if not available
# 09/09/2008 - jfs - Use prelink to calculate checksums if present (Debian
bug #445531)
@@ -116,15 +126,6 @@
haveallcmds MD5SUM CAT CUT SED GREP EGREP BASENAME || exit 1
-# Prelink
-PRELINK=/usr/sbin/prelink
-if [ -x "$PRELINK" ] ; then
- MD5SUM="$PRELINK -y --md5"
- MD5SUM_CALL="$MD5SUM"
-else
- MD5SUM_CALL="$MD5SUM -c"
-fi
-
DIVERSIONS="/var/lib/dpkg/diversions"
if [ -d /var/lib/dpkg/info ]
@@ -146,18 +147,20 @@
# { ls -d /usr/share/* |while read dir; do [ -d "$dir" ] && { echo -n
"$dir:" ; find "$dir" -type f | wc -l ; } ; done ; } | awk -F : '{print $2"
"$1;}' | sort -n |less
#
$CAT "$md5file" |
- $EGREP -v
"usr/share/[doc|help|man|icons|pixmaps|i18n|locale|mime|games]/" |
+ $EGREP -v
"usr/share/(doc|help|man|icons|pixmaps|fonts|i18n|locale|mime|games)/" |
$GREP -v " dev/" |
$GREP -v " lib/udev/devices/" |
$SED -e "s/^\(.*\) \(.*\)/\1 \/\2/" |
- $MD5SUM_CALL -c 2>&1 | $SED -e "s/^.*md5sum: MD5 check failed for
'\(.*\)'/DIFF \1/; s/^.*md5sum: can't open \(.*\)/ERR \1/" | {
- while read file err
+ $MD5SUM -c 2>&1 | $SED -n -e "s/^\(.*\): FAILED open or read$/ERR \1/p" \
+ -e "s/^\(.*\): FAILED$/DIFF \1/p" \
+ -e "s/^.*md5sum: MD5 check failed for '\(.*\)'/DIFF \1/p" \
+ -e "s/^.*md5sum: can't open \(.*\)/ERR \1/p" | {
+ while read err file
do
package=`$BASENAME "$md5file" ".md5sums"`
- file=`echo $file | sed -e "s/:$//"`
# echo "DEBUG: Checking file $file of $package ($err)" >&2
case $err in
- DIFF|FAILED)
+ DIFF)
# don't check diverted now
[ -z "`$GREP -sxF \"$file\" $DIVERSIONS`" ] &&
# and conffiles should not be checked either
@@ -169,7 +172,7 @@
;;
ERR)
# Check if this package
- if $GREP -sqxF \"$file\" /var/lib/dpkg/info/$package.list ; then
+ if [ ! -e "$file" ] && $GREP -sqxF "$file"
/var/lib/dpkg/info/$package.list ; then
message FAIL lin006f "" "Cannot check file \"$file\" provided by
\"$package\" since it does not exist"
fi
