Package: debootstrap
Version: 1.0.145
Severity: important
Tags: d-i
X-Debbugs-Cc: debian-amd64@lists.debian.org, debian-boot@lists.debian.org
User: debian-amd64@lists.debian.org
Usertags: amd64
User: debian-boot@lists.debian.org
Usertags: amd64
User: debian-qa@lists.debian.org
Usertags: openqa

Hi,

As seen on openQA [1], the installation with the daily netinst image fails because the installer cannot properly verify the .deb files provided from the netinst installer image.

The new code finds a SHA512 checksum in the Release file, but in the Packages file (/dists/forky/main/binary-amd64/Packages.gz) there is 'only' a SHA256 checksum.

As a work-around: When I modify line 741 from `SHA_SIZE=512` to `SHA_SIZE=256` the installation is able to proceed as usual (but the stronger checksum will not be used).

With kind regards,
Roland Clobus

[1] https://openqa.debian.net/tests/568370#step/install_base/17

Hello Steve, lists,

Debootstrap 1.0.145 now knows about SHA512 checksums, but the current netinst images do not contain these checksums in the Packages files (the SHA512 checksum is present in the Releases file, so debootstrap decides to use only the SHA512 checksum, resulting in error messages about corrupt packages).

For some reason Salsa does not allow me to create a merge request, so could you perhaps cherry-pick my modifications [1]:
efd128c55a2979843b6e81a1550c18cbccaf8417: Add SHA512
53e97cf9c242e1b10cda24b2c943583aabadab8c: Minor bugfix for SHA256

With kind regards,
Roland Clobus

[1] https://salsa.debian.org/rclobus/debian-cd/-/commits/rclobus%2Fsupport_sha512/?ref_type=heads

This bug is filed against debootstrap but these patches are against
debian-cd. Which package is faulty, debootstrap for not using available
SHA256 checksums or debian-cd for not providing SHA512 checksums ?

Arguably both? I'll take a look at debian-cd shortly...

Control: severity -1 serious

debian-cd currently has a mixture of SHA512 and SHA256, whereas the new version of debootstrap picks the strongest and assumes that it will be available for both file types.

I propose to have the fix in debian-cd, and keep the current implementation of debootstrap.
However the migration of debootstrap to forky should be stalled until the daily netinst images are ready for SHA512. So I've raised the severity to RC.

With kind regards,
Roland Clobus

I'm going to have to NACK this on the debian-cd side, debootstrap
needs to cope better and take the best available checksum rather than
fail here.

The issue is that debian-cd does *not* calculate the checksums for the
Packages{,.gz) files when it's generating images. It simply passes on
the information that was provided to it from the archive's Packages
files via apt-cache. The archive simply doesn't have SHA512 sums for
forky, for example.

Hi,

I'm diving deeper and deeper...

debootstrap 1.0.145 effectively calls `DEBOOTSTRAP_CHECKSUM_FIELD=SHA512 /usr/lib/debootstrap/pkgdetails PKGS file:///cdrom /target/var/lib/apt/lists/_cdrom_dists_forky_main_binary-amd64_Packages gcc-16-base` from the `download_debs` function.

Because currently the daily netinst images do not provide a SHA512 checksum in the Packages file, the code at [1] leaves the string `cur_checksum` uninitialised. Effectively that means that the reference checksum contains garbage and therefore the checksum match will always fail.

Proposal: initialise the string 'cur_checksum' with "missing_checksum" in base-installer.
Then if the checksum equals 'missing_checksum' in debootstrap and SHA512 was requested, call pkgdetails again, with DEBOOTSTRAP_CHECKSUM_FIELD=SHA256

With kind regards,
Roland Clobus

[1] https://salsa.debian.org/installer-team/base-installer/-/blob/master/pkgdetails.c?ref_type=heads#L178