On Thu, Sep 03, 2026 at 10:00:41AM +0100, Steve McIntyre wrote:
>On Thu, Sep 03, 2026 at 10:54:43AM +0200, Pascal Hambourg wrote:
>>On 03/09/2026 at 10:27, Roland Clobus wrote:
>>>
>>> Debootstrap 1.0.145 now knows about SHA512 checksums, but the current
>>> netinst images do not contain these checksums in the Packages files (the
>>> SHA512 checksum is present in the Releases file, so debootstrap decides
>>> to use only the SHA512 checksum, resulting in error messages about
>>> corrupt packages).
>>>
>>> For some reason Salsa does not allow me to create a merge request, so
>>> could you perhaps cherry-pick my modifications [1]:
>>This bug is filed against debootstrap but these patches are against
>>debian-cd. Which package is faulty, debootstrap for not using available
>>SHA256 checksums or debian-cd for not providing SHA512 checksums ?
>
>Arguably both? I'll take a look at debian-cd shortly...
I'm going to have to NACK this on the debian-cd side, debootstrap
needs to cope better and take the best available checksum rather than
fail here.
The issue is that debian-cd does *not* calculate the checksums for the
Packages{,.gz) files when it's generating images. It simply passes on
the information that was provided to it from the archive's Packages
files via apt-cache. The archive simply doesn't have SHA512 sums for
forky, for example.
--
Steve McIntyre, Cambridge, UK. [email protected]
"You can't barbecue lettuce!" -- Ellie Crane
