Package: base-installer
Severity: important
Tags: patch
Dear Maintainer,
pkgdetails's dopkgmirrorpkgs() in pkgdetails.c never initializes cur_size or
cur_checksum, and never resets them between stanzas. Until now every Packages
stanza carried MD5sum and Size, so both were always assigned before use.
debootstrap 1.0.145 ("Use SHA512 if listed in Release file", uploaded
2026-08-31) added checksum algorithm negotiation by exporting
DEBOOTSTRAP_CHECKSUM_FIELD, which makes the selected field a value a stanza may
legitimately lack.
When the selected field is absent from a stanza, pkgdetails prints the
uninitialized cur_checksum buffer in the checksum column of its FIELD output.
In my case it emitted a single garbage byte, which defeats debootstrap's [ -z
"$expchecksum" ] skip-comparison check, so every package fails checksum
validation. The result is that "Install the base system" fails
(base-installer/debootstrap-failed) after 10 acquisition retries per package,
on perfectly good media. Stanzas missing only one of Size/checksum also
silently inherit the previous stanza's value.
Observed in the wild: offline installer ISOs built with
kalilinux/build-scripts/kali-installer, which pull debootstrap-udeb 1.0.145
from the current kali-rolling mirror, fail at "Install the base system" with
every package reported corrupt. The trigger chain is Debian tooling throughout:
debian-cd's make_disc_trees.pl emits a SHA512 section into the Release file
unconditionally, while the Packages stanzas copied from the mirror only carry
MD5sum/Size/SHA256; debootstrap 1.0.145 then negotiates SHA512; pkgdetails
never sees a SHA512: line and prints uninitialized stack memory. The official
Kali 2026.3 installer ISO carries the same Release/stanza skew but ships
debootstrap 1.0.144 (no negotiation logic) and installs cleanly.
I have not verified whether Debian's own installer media is currently affected;
that depends on whether current Debian Packages stanzas carry SHA512 fields. If
they do not, any d-i image pairing the current mirror with debootstrap >=
1.0.145 would hit the same failure.
Standalone reproducer (no installer environment needed):
cc -O2 -o pkgdetails pkgdetails.c
DEBOOTSTRAP_CHECKSUM_FIELD=SHA512 ./pkgdetails FIELD 'Package:' \
cdrom/ Packages gcc-16-base
# checksum column contains uninitialized stack bytes
DEBOOTSTRAP_CHECKSUM_FIELD=SHA256 ./pkgdetails FIELD 'Package:' \
cdrom/ Packages gcc-16-base
# checksum column contains the correct hash
Fix: initialize cur_size/cur_checksum alongside the other per-stanza
buffers and clear them on each Package: line, so a missing field yields
an empty output column, which debootstrap already treats as "field
not present". Patch:
--- begin patch ---
--- pkgdetails.c 2026-10-23 06:18:17.441891065 -0400
+++ pkgdetails_fix.c 2026-10-23 06:19:09.163481475 -0400
@@ -143,7 +143,8 @@
char *output = NULL;
int output_pkg = -1;
- cur_field[0] = cur_pkg[0] = cur_ver[0] = cur_arch[0] = cur_filename[0] =
prev_pkg[0] = '\0';
+ cur_field[0] = cur_pkg[0] = cur_ver[0] = cur_arch[0] = cur_size[0] =
+ cur_checksum[0] = cur_filename[0] = prev_pkg[0] = '\0';
for (i = 0; i < pkgc; i++) pkgs[i] = in_pkgs[i];
@@ -159,6 +160,7 @@
}
if (strncasecmp(buf, "Package:", 8) == 0) {
fieldcpy(cur_pkg, buf);
+ cur_size[0] = cur_checksum[0] = '\0';
if (strcmp(cur_pkg, prev_pkg) != 0) {
if (output)
fputs(output, stdout);
--- end patch ---
Happy to open a Salsa MR against installer-team/base-installer if preferred.
--
Mikie
[email protected]
