4

Often when installing or upgrading packages the following appears in the log:

* ….tar.gz SHA256 SHA512 WHIRLPOOL size ;-) ...

What does this mean and what does the emoticon signify? ;-)

  • 1
    It's an emotion icon, better known by the portmanteau "emoticon". It is a metacommunicative pictorial representation of a facial expression that, in the absence of body language and prosody, serves to draw a receiver's attention to the tenor or temper of a sender's nominal verbal communication, changing and improving its interpretation. It expresses — usually by means of punctuation marks — a person's feelings or mood, though as emoticons have become more popular, some devices have provided stylized pictures that do not use punctuation. – Angry Lettuce May 18 '15 at 8:44
  • 10
    @ParkYoung-Bae Are you from Microsoft user support? – SF. May 18 '15 at 9:45
6

When a package maintainer creates a version of a package, the repoman tool takes the input files, usually a tar archive with source code and the ebuild itself, and calculate a number of hashes on it. This information is then recorded in a packages Manifest file.

Before portage unpacks and compiles the package, it verifies that all these hashes are accurate.

For example, if you look at /usr/portage/app-editors/vim/Manifest, you'll see a list of files for that package, along with a list of hashes.

The check you are seeing is portage having verified that the hashes are right, and it will then proceed to unpacking/compiling/installing.

The specific list you are seeing SHA256 SHA512 WHIRLPOOL size tells you that portage successfully verified the hashes SHA256, SHA512, WHIRLPOOL, and in addition, the file size.

Why there's a smiley in there, I don't really know.

To test the above, and see the check fail, simply make any small change to an e-build, and then try to install it.

For example, changing a single letter in what is the current vim version at the time of writing, I get:

# emerge -vp vim

These are the packages that would be merged, in order:

Calculating dependencies /
 * Digest verification failed:
 * /usr/portage/app-editors/vim/vim-7.4.273.ebuild
 * Reason: Failed on SHA256 verification
 * Got: 376375965ab5830f176e9825e1f69b98f88d14331db5527317308b201befa933
 * Expected: cbc64bcd5136f7c6059e379634e75117062204075001cf861d18a589c6f8535d
  • "Which seems entirely redundant" I once calculated md5 hashes of all files on my harddrive. Had hundreds of false matches first, but just two in the second run, when I distinguished by file size as well. You don't want a single false match here, especially not when the file size is different. – Alexander May 18 '15 at 12:25
  • @Alexander Getting even two false matches on a typical harddrive would require extraordinary luck: stackoverflow.com/a/288519/914716 . Were you using full 128-bit (32 hex characters) hashes or some truncated version? – jpa May 18 '15 at 12:53
  • @Alexander I have to agree with jpa. Even getting two files with different content, but the same md5 hash, is exceedingly unlikely. This would normally require an engineered attempt of some sort. Having "hundreds of false matches", is simply inconceivable. Add to that, that in the case above, portage has already checked three separate hashes, and the use of the size check gets even smaller. – user50849 May 18 '15 at 14:00
  • 1
    @Alexander indeed there were some interesting news regarding PHP and MD5 recently: news.ycombinator.com/item?id=9484757 (apparently the automatic type conversion in PHP wreaks havoc with some hash values returned by MD5). – oliver May 18 '15 at 14:58
  • 1
    I strikes me though, that checking the file size first, is very cheap, and if it fails to match, there's no point in calculating the hashes anyway, so it's a convenient shortcut to save some time. – user50849 Jun 2 '15 at 8:43
5

SHA256 SHA512 WHIRLPOOL size is a list of digest that are verified and the smiley represents a successful installation of the package, i.e. the package is installed and all hashes and file sizes are matching the expected values.

So WHIRLPOOL refers to a hash algorithm, similarly to the preceding SHA hashes.

  • @user50849 thank you for the editing suggestion! – FloHimself May 18 '15 at 9:44
  • What about "size"? – SF. May 18 '15 at 9:46
  • Did you mean verification instead of installation? – rightfold May 18 '15 at 9:48
  • 1
    @SF. size is just one more digest that is checked, i.e. installed size equals expected size. – FloHimself May 18 '15 at 9:49
  • 2
    But it's not installed size, it's tarball size. Otherwise, it couldn't be checked until it was ready to install. And since Gentoo allows so much customization of packages, installed size isn't consistent anyway. – cjm May 18 '15 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.