** Description changed: + [ Impact ] + + * When attempting to bootstrap a suite which only provides SHA512 + checksums in its Release/InRelease files, debootstrap crashes with "E: + Invalid Release file..." + + * This mostly impacts developers and potentially certain development + workflows/automations + + [ Test Plan ] + + * Run `sudo debootstrap stonking ./stonking-chroot + http://archive.ubuntu.com/ubuntu/` + + * This should successfully parse the Release file, download all + packages and complete + + [ Where problems could occur ] + + * If the fix modifies the parsing incorrectly it could affect the + chroot generation for other suites/series + + * debootstrap is used in tooling such as livecd-rootfs. Regressions in + this package could negatively impact these automations. + + [ Other Info ] + + * The fix was accepted verbatim upstream (meaning debian): + https://salsa.debian.org/installer-team/debootstrap/-/merge_requests/151 + + * We don't plan to enable SHA512 in Release/InRelease for older series, + so this is strictly for developers on resolute creating a stonking + chroot + + --- + debootstrap currently hardcodes SHA_SIZE to 256 in ./debootstrap/debootstrap which fails with the new SHA512 only stonking index files. This is also affecting livecd-rootfs builds of stonking (one buildlog example: https://launchpadlibrarian.net/868008144/buildlog_ubuntu_stonking_amd64_edubuntu_BUILDING.txt.gz) The fix here would be to first check if SHA512 is available and then falling back to SHA256 (we must prefer sha512 over sha256 since the by- hash/ folders are only guaranteed to exist for the strongest hash in the Release file). ``` Decompressing http://archive.ubuntu.com/ubuntu/dists/stonking/multiverse/debian-installer/binary-amd64/Packages.xz file ... /usr/bin/germinate-update-metapackage: Unable to retrieve package list from debootstrap; stdout: stderr: I: Retrieving InRelease 2026-07-07 14:50:38 URL:http://archive.ubuntu.com/ubuntu/dists/stonking/InRelease [82137/82137] -> "/home/erich/Projects/ubuntustudio-meta/debootstrap-dir/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists_stonking_InRelease" [1] I: Checking Release signature gpgv: Signature made Tue 07 Jul 2026 12:39:30 PM PDT gpgv: using RSA key F6ECB3762474EDA9D21B7022871920D1991BC93C gpgv: Good signature from "Ubuntu Archive Automatic Signing Key (2018) <[email protected]>" I: Valid Release signature (key id F6ECB3762474EDA9D21B7022871920D1991BC93C) E: Invalid Release file, no entry for main/binary-amd64/Packages ```
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2160111 Title: Debootstrap fails with stonking due to hardcoded sha256 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/debootstrap/+bug/2160111/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
