Re: Please, use --check=crc32 or switch to a safe format

[Pádraig Brady]

On 27/03/17 19:55, Michael Stone wrote:
> On Mon, Mar 27, 2017 at 11:47:10PM +0100, Ariel Santana Naranjo wrote:
>> If changing xz's options can't fix the problem, would you re-add a
>> second format?  Until coreutils-8.13 the tarball was distributed in two
>> formats.  I think adding a second format would fix the problem for
>> busybox and for pristine-tar because xz seems to be the only format
>> affected by these problems!
> 
> What, exactly, is the problem?

busybox's unxz can't detect bit errors during uncompression
due to not supporting the default crc64 checksum generated by xz.
It could if you generate the tarball with xz --check=crc32.
Though I don't think it's practical to adjust all projects
to pass this option to xz; rather adding crc64 support to
unxz seems like the best approach.

Note if you're extracting the tarball then you're not on a
deeply embedded device without a compiler etc. so it would
be surprising that xz would not be available.  Even in that
extreme edge case, you could use an intermediate system to
extract and checksum the data.

Pádraig.