Bootiso should automatically detect shaX and md5 files to check sums against ISO

[jsamr]

[SibrenVasse]

I've made an implementation which looks in the directory of the ISO for the files:
md5sums*
MD5SUMS*
sha1sums*
SHA1SUMS*
sha256sums*
SHA256sums*
$filename.md5
$filename.sha1
$filename.sha256
$filename.sha512

Is that everything?

[jsamr]

@SibrenVasse Thanks Sibren!

I think it's a de facto standard to use $filename.{ext}
I would go for

$filename.md5
$filename.sha1
$filename.sha256
$filename.sha512

and eventually add a flag such as --check-file-hash (...).{ext} for exotic names.

EDIT: I don't know other popular hash algorithms in this use case, but we can of course stay open to extension in the future

[SibrenVasse]

I also wanted to support hashfiles provided by distros. Debian does it like this:
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/
and arch like this:
https://mirrors.evowise.com/archlinux/iso/2019.01.01/
Or do you only want to support the $filename.$hash files?

Thus far, I've got these flags:
--no-hash-check) disable hash checking altogether
--force-hash-check) fail if no valid hash is found

Maybe --hash-file would be a nice flag name for the extra file to check?

[jsamr]

Maybe --hash-file would be a nice flag name for the extra file to check?

Definitly.

To understand your implementation schedule, what do you plan to do when a check fails while he hasn't used any related flag; prompt the user with an error?

The issue with a md5sums.txt file hanging in a directory is that we have no clue it is related to the ISO... So I am reluctant to automate anything that isn't predictable.

I would eventually accept the following flows :

Flow I : $filename.$hash exists

1. if --no-hash-check is not set, automatically check the sum
2. if the test fails:
   a. if --force-hash-check, failAndExit
   b. else print an echowarn message and prompt the user

Flow II : hash candidate exists (md5sums*)

1. if --no-hash-check is not set, prompt and ask the user if he wants to check this file
2. Do I.2

Flow III, --hash-file set

1. If hash file does not exists, failAndExit
2. Do I.2

[SibrenVasse]

Well the hash files contain the filenames along with the hashes. So we can check if a md5sums* file is relevant to the iso, and only fail if the filename is in there.

So as I've currently implemented it:

Flow I : $filename.$hash exists

1. if --no-hash-check is not set, automatically check the sum
2. if the test fails:
   a. if --force-hash-check, failAndExit
   b. else print an echowarn message and prompt the user

Flow II : hash candidate exists (md5sums*)

1. if --no-hash-check is not set and md5sums* contains filename
2. Do I.2

Flow III, --hash-file set

1. If hash file does not exists, failAndExit
2. Do I.2 for all hash types

Flow IV, --force-hash-check set

1. After all above flows, no applicable hash is found, failAndExit

If you'd like some changes to this, let me know!

[SibrenVasse]

Also about the dependencies:
{"md5sum", "sha1sum", "sha256sum", "sha512sum"} reside in coreutils on debian and archlinux.
Do we need to add coreutils as a dependency?

[jsamr]

Well the hash files contain the filenames along with the hashes. So we can check if a md5sums* file is relevant to the iso, and only fail if the filename is in there.

So as I've currently implemented it:

Flow I : $filename.$hash exists

1. if --no-hash-check is not set, automatically check the sum

2. if the test fails:
   a. if `--force-hash-check`, failAndExit
   b. else print an echowarn message and prompt the user

Flow II : hash candidate exists (md5sums*)

1. if `--no-hash-check` is not set and md5sums* contains filename

2. Do I.2

Flow III, --hash-file set

1. If hash file does not exists, failAndExit

2. Do I.2 for all hash types

Flow IV, --force-hash-check set

1. After all above flows, no applicable hash is found, failAndExit

If you'd like some changes to this, let me know!

Yes you are absolutely right (guess I've been lazy enough to never open a md5sum file) ; I'm good with these flows.

Also about the dependencies:
{"md5sum", "sha1sum", "sha256sum", "sha512sum"} reside in coreutils on debian and archlinux.
Do we need to add coreutils as a dependency?

yes, please append commandDependencies and commandPackages lists, mapping all the aforementioned utilities to coreutils