Re: Please, use --check=crc32 or switch to a safe format

[Matias Fonzo]

Hello Pádraig,

On Mon, 27 Mar 2017 20:28:35 -0700
Pádraig Brady <address@hidden> wrote:

> On 27/03/17 19:55, Michael Stone wrote:
> > On Mon, Mar 27, 2017 at 11:47:10PM +0100, Ariel Santana Naranjo
> > wrote:  
> >> If changing xz's options can't fix the problem, would you re-add a
> >> second format?  Until coreutils-8.13 the tarball was distributed
> >> in two formats.  I think adding a second format would fix the
> >> problem for busybox and for pristine-tar because xz seems to be
> >> the only format affected by these problems!  
> > 
> > What, exactly, is the problem?  
> 
> busybox's unxz can't detect bit errors during uncompression
> due to not supporting the default crc64 checksum generated by xz.
> It could if you generate the tarball with xz --check=crc32.
> Though I don't think it's practical to adjust all projects
> to pass this option to xz; rather adding crc64 support to
> unxz seems like the best approach.
> 
> Note if you're extracting the tarball then you're not on a
> deeply embedded device without a compiler etc. so it would
> be surprising that xz would not be available.

Err, busybox supplies xz...

> Even in that extreme edge case, you could use an intermediate
> system to extract and checksum the data.

What if this intermediate system is not available?.

pgpvStOzg1Q3Z.pgp
Description: OpenPGP digital signature