bug#15644: Possible bug in md5sum, sha1 and sha2 checksum utilities

[Eric Blake]

tag 15644 notabug
thanks

On 10/18/2013 07:48 AM, address@hidden wrote:
> Hi,
>    First, I hope this isn't some strange manifestation of shell
> backslash escaping that has fooled me. I've fiddled around trying to
> eliminate that possibility, but it could still happen. Apologies if it is...

No, what you are seeing is intentional.  It also occurs for literal
newlines in files.  Basically, since *sum output is line oriented, we
have to have a way to escape newlines in file names; and in order to
escape newlines, we also have to have a way to escape our escape.
Hence, we have documented that our output format starts with a backslash
on any line where the filename requires unescaping.


> # Checksum it.
>>>> sha1sum 'jun\k'
> \da39a3ee5e6b4b0d3255bfef95601890afd80709  jun\\k
> 
> # Checksum it via stdin.
>>>> sha1sum <'jun\k'
> da39a3ee5e6b4b0d3255bfef95601890afd80709  -
> 
> In case the backslashes don't make it through the email system, the file
> has a single backslash in its name. The first checksum starts with a
> backslash. The second doesn't. I think both outputs should be the same.

The difference on checking the named file vs. checking from stdin is
that from stdin, nothing needs escaping.  The difference is intentional,
and there's nothing to fix, at least not related to your question.

[There IS the related matter that we SHOULD be escaping carriage returns
as well, because of sum files that get transmitted with DOS-style line
endings; the fact that we have unambiguous output for newline, but not
for trailing carriage return (was it part of the file name or just the
transmitter sending it in DOS format?) is awkward]

I'm closing this as not a bug, but feel free to add further comments to
the thread as needed.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

signature.asc
Description: OpenPGP digital signature