oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-06 01:16:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(installer): repair OpenSSL fallback in hash_sha256 (#5521)

Browse Source 
Motivation: when gsha256sum, sha256sum and shasum are all absent but openssl
is available, install.sh fails checksum verification. The fallback ran
`openssl -dst openssl dgst -sha256`, which is an invalid command, and would
also have failed on `cut -d ' ' -f a`, an invalid field argument. The
installer exits 1 and installs nothing; checksum verification is not bypassed.

Approach: call `openssl dgst -sha256 "$TARGET"` and take the digest as the
last space-separated token of its "SHA256(file)= <digest>" output
(also "SHA2-256(...)" on OpenSSL 3.x), using POSIX parameter expansion.

Validation: added test_hash_sha256_openssl in test/install/0_checksums_test.sh,
which overrides is_command so only openssl is found and checks the digest of
the fixture archive (file and stdin). Running `sh 0_checksums_test.sh` in
test/install fails on the test before the change ("Invalid command '-dst'")
and passes after. Run on macOS with the system openssl only; the full
installer run from the issue and the container-based make targets were not run.

Report: https://github.com/anchore/syft/issues/5520

Assisted-by: claude-sonnet-5-5 (via Claude Code)

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
This commit is contained in:
Pujitha Paladugu
2026-11-05 20:17:31 +00:00
committed by GitHub
co-authored by Pujitha Paladugu
parent fa02ff2d26
commit c581c84ff1
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/install/0_checksums_test.sh
+14
View File
@@ -53,6 +53,20 @@ test_hash_sha256() {
run_test_case test_hash_sha256
# verify 256 digest of a file when openssl is the only available hash tool
test_hash_sha256_openssl() {
target=./testdata/assets/valid/syft_1.5.0_linux_arm64.tar.gz
# hide the other hash tools (within subshells) so that hash_sha256 falls back to openssl
actual=$(is_command() { [ "$1" = "openssl" ]; }; hash_sha256 "${target}")
assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum"
actual=$(is_command() { [ "$1" = "openssl" ]; }; hash_sha256 < "${target}")
assertEquals "8d57abb57a0dae3ff23c8f0df1f51951b7772822e0d560e860d6f68c24ef6d3d" "${actual}" "mismatched checksum (stdin)"
}
run_test_case test_hash_sha256_openssl
# verify 256 digest of a file relative to the checksums file
test_hash_sha256_verify() {