sha256sum check fails on ./boot/grub/efi.img XFCE flavour

[antipodes5]

Hi

I've downloaded SpiralLinux_XFCE_12.231120_x86-64.iso.

I checked the sha1 and md5 sums and the file passed.

However, there is sha256sum data in the .iso payload. Running it:

$ sha256sum -c sha256sum.txt
...
./boot/grub/efi.img: FAILED
...
sha256sum: WARNING: 1 computed checksum did NOT match

I've run this twice, same result.

For a sanity check, I downloaded the .iso a second time and compared:

$ diff 'SpiralLinux_XFCE_12.231120_x86-64(2).iso' SpiralLinux_XFCE_12.231120_x86-64.iso
$

i.e. no result, no difference.

By contrast, I checked the Plasma edition - its fine.

This is a problem. Can you address it?

[geckolinux]

Hi there, I honestly have no idea. I tested SpiralLinux_LXQt_12.231120_x86-64.iso with the method you described and it reported 2 mismatches:

./live/initrd.img-6.5.0-0.deb12.1-amd64: FAILED
./live/vmlinuz-6.5.0-0.deb12.1-amd64: FAILED

I build the ISOs on a single-use VPS as described [1] here [2] and then I upload them directly from there to Sourceforge with scp . I would tend to suspect a simple checksum bug in live-build, which is just a crude hodgepog of BASH scripts that perform some of the same actions multiple times during different stages of the ISO generation process (i.e. installing packages and then uninstalling them, and generating and re-generating initrd images in the chroot build environment), so in theory it could be checksum'ing the wrong files at the wrong stage.

I'll compare the checksums the next time I release a set of updated ISOs. If you're interested you can also follow the above mentioned instructions to build your own SpiralLinux ISO and test it.

[antipodes5]

Thanks for your reply.

If I have time later in the week I might play around with the method described. But honestly I am much more interested in the .iso files.

I remain interested, so if you solve it, please let me/us know. I hear good things about this OS.

Thanks.

[geckolinux]

Thanks for your good observations.

It looks like there is definitely some leeway for non-malicious changes in certain files at some point in the ISO generation process, especially vmlinuz and initrd images:

• https://askubuntu.com/questions/1259931/check-error-with-20-04-desktop-iso
  • https://bugs.launchpad.net/ubuntu/+bug/1888033

That bug report involves people booting into the media check tool on the Ubuntu live ISO, which isn't the exact same thing, but it does involve legitimate changes to the initrd, and the live-build process for SpiralLinux also generates the initrd several times if memory serves me correctly, because SpiralLinux includes some kernel -dkms module packages.

Here's another interesting finding: I just downloaded this ISO from the Nodiscc project, which is what I used as a starting point to learn the live-build system for SpiralLinux. Decompressing that ISO and running sha256sum -c sha256sum.txt also reveals:

./live/initrd.img-6.1.0-14-amd64: FAILED
...
./live/vmlinuz-6.1.0-14-amd64: FAILED

So that personally puts me at ease, because Nodiscc uses a completely different process and infrastructure to build and publish their ISOs, but with the same live-build tool for Debian Stable, and they have this same anomaly.

[antipodes5]

Interesting, and I guess a relief. If I'm honest, I don't understand all of what you've written, I just don't have the skill.

But you're still in a situation (as a user like me) where you have to decide, is this a 'false positive'?

[geckolinux]

Yep, I understand. It's always good to be cautious with software.

[antipodes5]

I had a disaster with my ubuntu (noble) installation (the thing stopped being able to handle logins and disc decryption - apparently others have had similar issues. Plymouth something). So I played around with installing the two of your .isos I have, KDE and XFCE (with the above problem).

Observations:

• KDE installs well and looks nice, except it refuses to log into my wifi. It just tries, fails and keeps prompting me for the password. I'll update my other post.
• the XFCE looks and works great on the live usb, wifi too. However, it fails on the installation (twice). I am sorry, but I can't remember where in the process / log it was when it failed and I can't do it again. Could it be corruption in that particular file?

Constructively, .