CHA 256 checksum fail

[Panicof1907]

To make a long story short, I am trying to update my 'sudo' in command line terminal as it's buggy and out of date. From my understanding, I can start by going here to update sudo:

Download Sudo

Sudo is distributed in source and and binary package formats. For information on how the binary packages are built, see building packages. All source distributions and binary packages are signed with Todd’s PGP key. For .rpm and .deb packages, the signature is embedded in the package file...

www.sudo.ws

It seems other MacOS users have done this in the past.

The problem is their 256 checksums NEVER match mine when I do:

shasum -a 256 /full/path/to/your/file

I always get a different number.

Is MacOS modifying the file in some way due to a different format, or has someone been tampering?

 

[chown33]

It works for me.

Which version are you downloading? What are you downloading it with?

What is the exact command-line you're using, and what is it's complete output?

 

[Panicof1907]

It works for me.

Thanks for verifying THAT part chown.

I decided to redownload now and test again.

I grabbed the sudo-1.9.4.tar.gz just now.

The 256 listed SHOULD be this:
8b91bd2cc73af18a06a01406e38d154b837107be759f72e89cefeaa94e1103f0

Yet for some reason, I get this:
61fa7198b35828622543d56e488ffb4d0b415418f22942250aeed93a823fa05a

I originally downloaded it through Safari, which puts it into my downloads folder.

Now, here is my command line to run the check-sum:
Tigerss-iMac-5:~ Tigers$ shasum -a 256 /Users/Tigers/Downloads/sudo-1.9.4.tar

And what I get is:

61fa7198b35828622543d56e488ffb4d0b415418f22942250aeed93a823fa05a /Users/Tigers/Downloads/sudo-1.9.4.tar


I noticed, that the .gz extension is removed by MacOS, but I'm not sure that's the issue after testing...

Hopefully, this is just something simple that this idiot is missing.

 

[chown33]

It's not just that the .gz suffix is being removed, it's that Safari is decompressing the download from its original gzipped format (what the .gz suffix indicates). What's left is an uncompressed tar file, and it will definitely have a different hash.


You should be able to confirm the decompression is happening by looking at the size of the .tar file vs. the size of the .tar.gz file. Sadly, the site doesn't show the file-size in the same table as the download link, but you can look here:

Index of /dist/

www.sudo.ws

That link is the parent directory where the download links point to specific .tar.gz files. Here's a small section of the page I see in my Firefox browser when I visit that page:

...
sudo-1.9.4.tar.gz 30-Nov-2020 13:44 3992062
sudo-1.9.4.tar.gz.sig 30-Nov-2020 13:45 566

That's pretty near the bottom of the page, and it shows the exact size in bytes of each file.

So use 'ls -l' on the .tar that Safari so helpfully decompressed, and it should be bigger. I see the decompressed .tar file as 17745920 bytes, and its sha256 is:

61fa7198b35828622543d56e488ffb4d0b415418f22942250aeed93a823fa05a sudo-1.9.4.tar

Of course, you shouldn't trust me for that SHA256 value, instead you should tell Safari not to decompress the download.


If you can't get Safari to cooperate, I can post a 'curl' command-line that will retrieve the .tar.gz file. Assuming you trust what I post.

 

[Panicof1907]

It's not just that the .gz suffix is being removed, it's that Safari is decompressing the download from its original gzipped format (what the .gz suffix indicates). What's left is an uncompressed tar file, and it will definitely have a different hash.

Thanks chown! You nailed it right there. I downloaded instead with Chrome right now, and indeed everything checks out now, with a smaller size to boot.

I will call it a day for now, and tomorrow resume my other problem, in upgrading my 'sudo' command. Haw! Take care for now.

 

[chown33]

Glad it worked out.

 

[EmmEff]

There is absolutely no practical reason for upgrading sudo on macOS. What do you expect to gain from this?