View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0009916Kali LinuxKali Package Bugpublic2026-10-26 22:282026-10-26 22:46
Reportermikie Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0009916: Installer ISO: Release advertises SHA512 but Packages lack it — offline installs fail with debootstrap >= 1.0.145
Description

Summary

Installer ISOs built from the current kali-rolling mirror fail offline ("Install the base system" -> debootstrap-failed) with every package reported corrupt. Root cause is a checksum field skew between the Release file and the Packages stanzas on our media, combined with debootstrap 1.0.145's new SHA512 negotiation.

What happens

  1. debian-cd's make_disc_trees.pl unconditionally writes a SHA512 section into dists/kali-rolling/Release.
  2. The Packages stanzas copied from the mirror only carry Size: and SHA256: (no SHA512 field) — reprepro byte-copies the mirror's stanzas, and the mirror stanzas have no SHA512.
  3. The installer initrd now pulls debootstrap-udeb 1.0.145 from the mirror (uploaded upstream 2026-08-31: "Use SHA512 if listed in Release file"). debootstrap sees the SHA512 section in Release and negotiates SHA512 for package validation.
  4. d-i's pkgdetails, asked for the SHA512 field that stanzas don't have, prints uninitialized memory (observed: a single garbage byte) instead of an empty string. This defeats debootstrap's "[ -z "$expchecksum" ]" skip-validation check, so every package fails checksum comparison. 10 acquisition retries per package, then base-installer/debootstrap-failed.

Evidence that the media are fine

Index SHA256 matches the file, Size matches, byte-perfect cp to /target verified, ample disk space. The failure is purely the checksum negotiation path. Verified on two build hosts (one vSphere VM, one bare-metal desktop, installed under KVM) — not hardware, not container artifacts.

The official 2026.3 ISO has the same skew

kali-linux-2026.3-installer-amd64.iso carries the identical skew: Release has a SHA512 section, gcc-16-base's stanza has only Size: 37984 and SHA256: 2c83b8b5a3ebe4431ca1f8f20370af04f8e80ca5a8726afd56f3fa1523f83e16. It installs cleanly only because it ships debootstrap-udeb 1.0.144, which predates the SHA512 negotiation. Any installer ISO rebuilt from the current mirror (debootstrap 1.0.145) will fail offline installs.

Related

  • Bug 0009658 reported the same signature (offline installer, every package failing cdrom:// fetch) and was closed unable-to-reproduce blaming hardware. The above explains it.
  • Filed upstream in Debian against base-installer for the pkgdetails uninitialized-memory bug: Debian bug #1151716.

Fix

Strip the SHA512 section from Release before md5sum.txt regeneration in the kali-installer build, forcing debootstrap to fall back to SHA256, which every stanza carries. Patch against kalilinux/build-scripts/kali-installer, simple-cdd/disc-end-hook:

index 27e3554..6e71c70 100755
--- a/simple-cdd/disc-end-hook
+++ b/simple-cdd/disc-end-hook
@@ -74,6 +74,18 @@ if [ -e dists/kali-last-snapshot ]; then
sed -i -e 's|kali-last-snapshot|kali-rolling|g' dists/kali-rolling/Release
fi

+# debian-cd's make_disc_trees.pl unconditionally emits a SHA512 section
+# into the Release file, but the Packages stanzas copied from the mirror
+# only carry MD5sum/SHA256. debootstrap >= 1.0.145 negotiates SHA512 for package
+# validation whenever Release advertises it, so every checksum comparison
+# fails and base-installer dies with debootstrap-failed.
+# Dropping the section forces SHA256, which every stanza has.
+if [ -e dists/kali-rolling/Release ]; then

  • awk '/^SHA512:/{f=1;next} f && /^[^ ]/{f=0} !f' \
  • dists/kali-rolling/Release > dists/kali-rolling/Release.new \
  • && mv dists/kali-rolling/Release.new dists/kali-rolling/Release
    +fi

  • Redo the md5sum.txt due to our changes

    find . -type f \
    | grep -v ./md5sum.txt \

Tested: rebuilt ISO with this hook completes a full offline install.

Activities

mikie

mikie

2026-10-26 22:46

reporter   ~0022105

I botched the diff formatting, attempt #2.

diff --git a/simple-cdd/disc-end-hook b/simple-cdd/disc-end-hook
index 27e3554..6e71c70 100755
--- a/simple-cdd/disc-end-hook
+++ b/simple-cdd/disc-end-hook
@@ -74,6 +74,18 @@ if [ -e dists/kali-last-snapshot ]; then
   sed -i -e 's|kali-last-snapshot|kali-rolling|g' dists/kali-rolling/Release
 fi

+# debian-cd's make_disc_trees.pl unconditionally emits a SHA512 section
+# into the Release file, but the Packages stanzas copied from the mirror
+# only carry MD5sum/SHA256. debootstrap >= 1.0.145 negotiates SHA512 for package
+# validation whenever Release advertises it, so every checksum comparison
+# fails and base-installer dies with debootstrap-failed.
+# Dropping the section forces SHA256, which every stanza has.
+if [ -e dists/kali-rolling/Release ]; then
+  awk '/^SHA512:/{f=1;next} f && /^[^ ]/{f=0} !f' \
+    dists/kali-rolling/Release > dists/kali-rolling/Release.new \
+    && mv dists/kali-rolling/Release.new dists/kali-rolling/Release
+fi
+
 # Redo the md5sum.txt due to our changes
 find . -type f \
   | grep -v ./md5sum.txt \

Issue History

Date Modified Username Field Change
2026-10-26 22:28 mikie New Issue
2026-10-26 22:46 mikie Note Added: 0022105