Hi, I'm diving deeper and deeper...
debootstrap 1.0.145 effectively calls `DEBOOTSTRAP_CHECKSUM_FIELD=SHA512 /usr/lib/debootstrap/pkgdetails PKGS file:///cdrom /target/var/lib/apt/lists/_cdrom_dists_forky_main_binary-amd64_Packages gcc-16-base` from the `download_debs` function. Because currently the daily netinst images do not provide a SHA512 checksum in the Packages file, the code at [1] leaves the string `cur_checksum` uninitialised. Effectively that means that the reference checksum contains garbage and therefore the checksum match will always fail. Proposal: initialise the string 'cur_checksum' with "missing_checksum" in base-installer. Then if the checksum equals 'missing_checksum' in debootstrap and SHA512 was requested, call pkgdetails again, with DEBOOTSTRAP_CHECKSUM_FIELD=SHA256 With kind regards, Roland Clobus [1] https://salsa.debian.org/installer-team/base-installer/-/blob/master/pkgdetails.c?ref_type=heads#L178
OpenPGP_signature.asc
Description: OpenPGP digital signature
