Dear Maintainer,

pkgdetails's dopkgmirrorpkgs() in pkgdetails.c never initializes cur_size or cur_checksum, and never resets them between stanzas. Until now every Packages stanza carried MD5sum and Size, so both were always assigned before use. debootstrap 1.0.145 ("Use SHA512 if listed in Release file", uploaded 2026-08-31) added checksum algorithm negotiation by exporting DEBOOTSTRAP_CHECKSUM_FIELD, which makes the selected field a value a stanza may legitimately lack.

When the selected field is absent from a stanza, pkgdetails prints the uninitialized cur_checksum buffer in the checksum column of its FIELD output. In my case it emitted a single garbage byte, which defeats debootstrap's [ -z "$expchecksum" ] skip-comparison check, so every package fails checksum validation. The result is that "Install the base system" fails (base-installer/debootstrap-failed) after 10 acquisition retries per package, on perfectly good media. Stanzas missing only one of Size/checksum also silently inherit the previous stanza's value.

Observed in the wild: offline installer ISOs built with kalilinux/build-scripts/kali-installer, which pull debootstrap-udeb 1.0.145 from the current kali-rolling mirror, fail at "Install the base system" with every package reported corrupt. The trigger chain is Debian tooling throughout: debian-cd's make_disc_trees.pl emits a SHA512 section into the Release file unconditionally, while the Packages stanzas copied from the mirror only carry MD5sum/Size/SHA256; debootstrap 1.0.145 then negotiates SHA512; pkgdetails never sees a SHA512: line and prints uninitialized stack memory. The official Kali 2026.3 installer ISO carries the same Release/stanza skew but ships debootstrap 1.0.144 (no negotiation logic) and installs cleanly.

I have not verified whether Debian's own installer media is currently affected; that depends on whether current Debian Packages stanzas carry SHA512 fields. If they do not, any d-i image pairing the current mirror with debootstrap >= 1.0.145 would hit the same failure.

Standalone reproducer (no installer environment needed):

  cc -O2 -o pkgdetails pkgdetails.c

  DEBOOTSTRAP_CHECKSUM_FIELD=SHA512 ./pkgdetails FIELD 'Package:' \
      cdrom/ Packages gcc-16-base
  # checksum column contains uninitialized stack bytes

  DEBOOTSTRAP_CHECKSUM_FIELD=SHA256 ./pkgdetails FIELD 'Package:' \
      cdrom/ Packages gcc-16-base
  # checksum column contains the correct hash

Fix: initialize cur_size/cur_checksum alongside the other per-stanza
buffers and clear them on each Package: line, so a missing field yields
an empty output column, which debootstrap already treats as "field
not present". Patch:
--- begin patch ---
--- pkgdetails.c	2026-10-23 06:18:17.441891065 -0400
+++ pkgdetails_fix.c	2026-10-23 06:19:09.163481475 -0400
@@ -143,7 +143,8 @@
     char *output = NULL;
     int output_pkg = -1;

-    cur_field[0] = cur_pkg[0] = cur_ver[0] = cur_arch[0] = cur_filename[0] = prev_pkg[0] = '\0';
+    cur_field[0] = cur_pkg[0] = cur_ver[0] = cur_arch[0] = cur_size[0] =
+    cur_checksum[0] = cur_filename[0] = prev_pkg[0] = '\0';

     for (i = 0; i < pkgc; i++) pkgs[i] = in_pkgs[i];

@@ -159,6 +160,7 @@
 	}
         if (strncasecmp(buf, "Package:", 8) == 0) {
             fieldcpy(cur_pkg, buf);
+            cur_size[0] = cur_checksum[0] = '\0';
             if (strcmp(cur_pkg, prev_pkg) != 0) {
                 if (output)
                     fputs(output, stdout);
--- end patch ---


Happy to open a Salsa MR against installer-team/base-installer if preferred.