Re: diffutils-3.9 released [stable]

[Bob Proulx]

> This is to announce diffutils-3.9, a stable release.
...
> Here are the compressed sources and a GPG detached signature:
>   https://ftp.gnu.org/gnu/diffutils/diffutils-3.9.tar.xz
>   https://ftp.gnu.org/gnu/diffutils/diffutils-3.9.tar.xz.sig
>
> Use a mirror for higher download bandwidth:
>   https://ftpmirror.gnu.org/diffutils/diffutils-3.9.tar.xz
>   https://ftpmirror.gnu.org/diffutils/diffutils-3.9.tar.xz.sig
>
> Here are the SHA1 and SHA256 checksums:
>
> 35905d7c3d1ce116e6794be7fe894cd25b2ded74  diffutils-3.9.tar.xz
> 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E  diffutils-3.9.tar.xz
>
> The SHA256 checksum is base64 encoded, instead of the
> hexadecimal encoding that most checksum tools default to.

What utility is used to produce the base64 encoded SHA256 checksum so
described?  So that this published checksum may be easily verified?

Isn't there a missing '=' padding character at the end of the base64
encoding?  Isn't that needed to properly decode it?  For all SHA256
sized checksums?

    $ echo 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E | base64 -d > /dev/null
    base64: invalid input

    $ echo $(sha256sum diffutils-3.9.tar.xz | awk '{print$1}' | xxd -r -p | 
base64) diffutils-3.9.tar.xz
    2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E= diffutils-3.9.tar.xz

I realize that I may do this following method to verify the file.  But
this seems like quite a bit more work than if the sha256sum hash were
given plainly.  Plus one must know to add the '=' padding.

    $ echo $(echo 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E= | base64 -d | 
xxd -c0 -p) diffutils-3.9.tar.xz
    d80d3be90a201868de83d78dad3413ad88160cc53bcc36eb9eaf7c20dbf023f1 
diffutils-3.9.tar.xz

    $ echo $(echo 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E= | base64 -d | 
xxd -c0 -p) diffutils-3.9.tar.xz | sha256sum -c
    diffutils-3.9.tar.xz: OK

What useful base64 sha256sum utility am I missing?

Bob