View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0009916Kali LinuxKali Package Bugpublic2026-10-26 22:282026-10-29 03:12
Reportermikie Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0009916: Installer ISO: Release advertises SHA512 but Packages lack it — offline installs fail with debootstrap >= 1.0.145
Description

Summary

Installer ISOs built from the current kali-rolling mirror fail offline ("Install the base system" -> debootstrap-failed) with every package reported corrupt. Root cause is a checksum field skew between the Release file and the Packages stanzas on our media, combined with debootstrap 1.0.145's new SHA512 negotiation.

What happens

  1. debian-cd's make_disc_trees.pl unconditionally writes a SHA512 section into dists/kali-rolling/Release.
  2. The Packages stanzas copied from the mirror only carry Size: and SHA256: (no SHA512 field) — reprepro byte-copies the mirror's stanzas, and the mirror stanzas have no SHA512.
  3. The installer initrd now pulls debootstrap-udeb 1.0.145 from the mirror (uploaded upstream 2026-08-31: "Use SHA512 if listed in Release file"). debootstrap sees the SHA512 section in Release and negotiates SHA512 for package validation.
  4. d-i's pkgdetails, asked for the SHA512 field that stanzas don't have, prints uninitialized memory (observed: a single garbage byte) instead of an empty string. This defeats debootstrap's "[ -z "$expchecksum" ]" skip-validation check, so every package fails checksum comparison. 10 acquisition retries per package, then base-installer/debootstrap-failed.

Evidence that the media are fine

Index SHA256 matches the file, Size matches, byte-perfect cp to /target verified, ample disk space. The failure is purely the checksum negotiation path. Verified on two build hosts (one vSphere VM, one bare-metal desktop, installed under KVM) — not hardware, not container artifacts.

The official 2026.3 ISO has the same skew

kali-linux-2026.3-installer-amd64.iso carries the identical skew: Release has a SHA512 section, gcc-16-base's stanza has only Size: 37984 and SHA256: 2c83b8b5a3ebe4431ca1f8f20370af04f8e80ca5a8726afd56f3fa1523f83e16. It installs cleanly only because it ships debootstrap-udeb 1.0.144, which predates the SHA512 negotiation. Any installer ISO rebuilt from the current mirror (debootstrap 1.0.145) will fail offline installs.

Related

  • Bug 0009658 reported the same signature (offline installer, every package failing cdrom:// fetch) and was closed unable-to-reproduce blaming hardware. The above explains it.
  • Filed upstream in Debian against base-installer for the pkgdetails uninitialized-memory bug: Debian bug #1151716.

Fix

Strip the SHA512 section from Release before md5sum.txt regeneration in the kali-installer build, forcing debootstrap to fall back to SHA256, which every stanza carries. Patch against kalilinux/build-scripts/kali-installer, simple-cdd/disc-end-hook:

index 27e3554..6e71c70 100755
--- a/simple-cdd/disc-end-hook
+++ b/simple-cdd/disc-end-hook
@@ -74,6 +74,18 @@ if [ -e dists/kali-last-snapshot ]; then
sed -i -e 's|kali-last-snapshot|kali-rolling|g' dists/kali-rolling/Release
fi

+# debian-cd's make_disc_trees.pl unconditionally emits a SHA512 section
+# into the Release file, but the Packages stanzas copied from the mirror
+# only carry MD5sum/SHA256. debootstrap >= 1.0.145 negotiates SHA512 for package
+# validation whenever Release advertises it, so every checksum comparison
+# fails and base-installer dies with debootstrap-failed.
+# Dropping the section forces SHA256, which every stanza has.
+if [ -e dists/kali-rolling/Release ]; then

  • awk '/^SHA512:/{f=1;next} f && /^[^ ]/{f=0} !f' \
  • dists/kali-rolling/Release > dists/kali-rolling/Release.new \
  • && mv dists/kali-rolling/Release.new dists/kali-rolling/Release
    +fi

  • Redo the md5sum.txt due to our changes

    find . -type f \
    | grep -v ./md5sum.txt \

Tested: rebuilt ISO with this hook completes a full offline install.

Activities

mikie

mikie

2026-10-26 22:46

reporter   ~0022105

I botched the diff formatting, attempt #2.

diff --git a/simple-cdd/disc-end-hook b/simple-cdd/disc-end-hook
index 27e3554..6e71c70 100755
--- a/simple-cdd/disc-end-hook
+++ b/simple-cdd/disc-end-hook
@@ -74,6 +74,18 @@ if [ -e dists/kali-last-snapshot ]; then
   sed -i -e 's|kali-last-snapshot|kali-rolling|g' dists/kali-rolling/Release
 fi

+# debian-cd's make_disc_trees.pl unconditionally emits a SHA512 section
+# into the Release file, but the Packages stanzas copied from the mirror
+# only carry MD5sum/SHA256. debootstrap >= 1.0.145 negotiates SHA512 for package
+# validation whenever Release advertises it, so every checksum comparison
+# fails and base-installer dies with debootstrap-failed.
+# Dropping the section forces SHA256, which every stanza has.
+if [ -e dists/kali-rolling/Release ]; then
+  awk '/^SHA512:/{f=1;next} f && /^[^ ]/{f=0} !f' \
+    dists/kali-rolling/Release > dists/kali-rolling/Release.new \
+    && mv dists/kali-rolling/Release.new dists/kali-rolling/Release
+fi
+
 # Redo the md5sum.txt due to our changes
 find . -type f \
   | grep -v ./md5sum.txt \
arnaudr

arnaudr

2026-10-29 03:12

administrator   ~0022117

Thanks for the report. I think I've fixed with a patch to debian-cd (version 3.2.3+kali1) that is now in kali-rolling. So the next batch of weekly images should be fixed (wait for W45 that will be published next Monday).

You can also rebuild your own ISOs, provided that your build environment is an up-to-date kali-rolling with debian-cd 3.2.3+kali1, that should work.

Issue History

Date Modified Username Field Change
2026-10-26 22:28 mikie New Issue
2026-10-26 22:46 mikie Note Added: 0022105
2026-10-29 03:12 arnaudr Note Added: 0022117