[Bug] Re3gression in setup handling of SHA512 checksum failures

Ken Brown kbrown@cornell.edu
Wed Mar 21 19:30:00 GMT 2018

On 3/20/2018 4:11 PM, Achim Gratz wrote:
> Ken Brown writes:
>> I'll look into both of these issues, unless Jon beats me to it.
> Thanks.
>> By the way, this only affects local installs.  For network installs,
>> the hash gets checked at an earlier stage.
> That's correct.  I forgot to mention that, but all my installs are from
> a local mirror (necessary due to the way network access is restricted at
> my workplace)

I haven't been able to come up with a safe way to recover from a 
checksum error at this point, at least not without a lot of work.  I 
propose that we just bail out with an appropriate error message in this 

Patch attached.

-------------- next part --------------
From 0607cb5da1bbe61cd132499082a62bbbc54c8dfd Mon Sep 17 00:00:00 2001
From: Ken Brown <kbrown@cornell.edu>
Date: Wed, 21 Mar 2018 14:03:00 -0400
Subject: [PATCH setup] Give a fatal error on a checksum failure during install

This only affects local installs, where the hash of an archive is not
checked until we reach do_install_thread().  At this point it seems
too late to recover safely.
 install.cc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/install.cc b/install.cc
index 37dea6f..b5adcc6 100644
--- a/install.cc
+++ b/install.cc
@@ -850,7 +850,15 @@ do_install_thread (HINSTANCE h, HWND owner)
       catch (Exception *e)
-        yesno (owner, IDS_SKIP_PACKAGE, e->what());
+	// We used to give the user a yes/no option to skip this
+	// package (with "no" meaning install it even though the
+	// archive is corrupt), but both options could damage the
+	// user's system.  In the absence of a safe way to recover, we
+	// just bail out.
+	if (e->errNo() == APPERR_CORRUPT_PACKAGE)
+	  fatal (owner, IDS_CORRUPT_PACKAGE, version.Name().c_str());
+	// Unexpected exception.
+	throw e;
         md5sum_total_bytes_sofar += version.source()->size;

More information about the Cygwin-apps mailing list