Re: diffutils-3.9 released [stable]

[Jim Meyering]

On Mon, Jan 16, 2023 at 1:57 PM Bob Proulx <bob@proulx.com> wrote:
> > This is to announce diffutils-3.9, a stable release.
> ...
> > Here are the compressed sources and a GPG detached signature:
> >   https://ftp.gnu.org/gnu/diffutils/diffutils-3.9.tar.xz
> >   https://ftp.gnu.org/gnu/diffutils/diffutils-3.9.tar.xz.sig
> >
> > Use a mirror for higher download bandwidth:
> >   https://ftpmirror.gnu.org/diffutils/diffutils-3.9.tar.xz
> >   https://ftpmirror.gnu.org/diffutils/diffutils-3.9.tar.xz.sig
> >
> > Here are the SHA1 and SHA256 checksums:
> >
> > 35905d7c3d1ce116e6794be7fe894cd25b2ded74  diffutils-3.9.tar.xz
> > 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E  diffutils-3.9.tar.xz
> >
> > The SHA256 checksum is base64 encoded, instead of the
> > hexadecimal encoding that most checksum tools default to.
>
> What utility is used to produce the base64 encoded SHA256 checksum so
> described?  So that this published checksum may be easily verified?
>
> Isn't there a missing '=' padding character at the end of the base64
> encoding?  Isn't that needed to properly decode it?  For all SHA256
> sized checksums?
>
>     $ echo 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E | base64 -d > /dev/null
>     base64: invalid input
>
>     $ echo $(sha256sum diffutils-3.9.tar.xz | awk '{print$1}' | xxd -r -p | 
> base64) diffutils-3.9.tar.xz
>     2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E= diffutils-3.9.tar.xz
>
> I realize that I may do this following method to verify the file.  But
> this seems like quite a bit more work than if the sha256sum hash were
> given plainly.  Plus one must know to add the '=' padding.
>
>     $ echo $(echo 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E= | base64 -d | 
> xxd -c0 -p) diffutils-3.9.tar.xz
>     d80d3be90a201868de83d78dad3413ad88160cc53bcc36eb9eaf7c20dbf023f1 
> diffutils-3.9.tar.xz
>
>     $ echo $(echo 2A076QogGGjeg9eNrTQTrYgWDMU7zDbrnq98INvwI/E= | base64 -d | 
> xxd -c0 -p) diffutils-3.9.tar.xz | sha256sum -c
>     diffutils-3.9.tar.xz: OK
>
> What useful base64 sha256sum utility am I missing?

Hi Bob,
That's a good question.
Simon (I think you added this), what do you use?
I hope it will be added to coreutils' cksum.