Re: SHA256 FAIL for miniroot69.img on ftp2.eu.openbsd.org

On 2021-08-10, Mihai Popescu <mihscu@gmail.com> wrote:
> I did some download from [1] and the SHA256 for miniroot69.img is FAIL.
> The files with _obsd trails are from [2] and they are verified OK.
> Build date: 1628609840 - Tue Aug 10 15:37:20 UTC 2021
>
> [1] https://ftp2.eu.openbsd.org/
> [2] https://ftp.openbsd.org/pub/OpenBSD/

Would be helpful to say which directory so we don't need to guess
between 6.9/snapshots and which arch.

> $ sha256 -C SHA256 miniroot69.img
> (SHA256) miniroot69.img: FAILED
> c$ signify -Cp /etc/signify/openbsd-69-base.pub -x SHA256.sig
> miniroot69.img
> Signature Verified
> miniroot69.img: FAIL
>
> $ cmp SHA256_obsd SHA256
>
> $ cmp SHA256_obsd.sig SHA256.sig
> $ cmp miniroot69_obsd.img miniroot69.img
>
> miniroot69_obsd.img miniroot69.img differ: char 32808, line 6
> $ diff SHA256_obsd SHA256
> $ diff SHA256_obsd.sig SHA256.sig
> $ diff miniroot69_obsd.img miniroot69.img
> Binary files miniroot69_obsd.img and miniroot69.img differ
>
> Tried other parameters for cmp and diff, but the list is huge for the first.
> $ cmp -l miniroot69_obsd.img miniroot69.img
> 32808 11 374
> 32809 21 34
> 32810 146 252
> 32811 357 267
> 33306 100 40
> 33308 0 23
> 33309 360 100
> 33310 377 1
> 33311 25 377
> 33312 140 17
> 33313 1 0
> 33314 27 0
> 33315 200 0
> 33316 1 0
> 33317 31 0
> 33318 240 0
> 33319 1 0
> 33320 33 0
> 33321 300 0
> 33322 1 0
> 33323 35 377
> 33324 340 17
> [ more displayed, output cut ]
>
> If somebody else can test this, please.
>
> Thanks.
>

You don't show the actual hash so it may have changed since you fetched,
but currently if I fetch snapshots/amd64/miniroot69.img from ftp2.eu
the hash doesn't match the SHA256 file in that directory, but it does match
the SHA256 file that I fetched on my local mirror earlier today.

I think it's most likely just that the mirror updated at an inconvenient
time, it happens fairly often with snapshots.

--
Please keep replies on the mailing list.