Install fails with spurious checksum mismatch (Arch Linux)

[JamesHarrison]

When running rbenv install 2.1.1 the process fails:

checksum mismatch: yaml-0.1.6.tar.gz (file is corrupt)
expected 5fe00cda18ca5daeb43762b80c38e06e, got 5fe00cda18ca5daeb43762b80c38e06e  -

Installing 2.1.0, this fails with the same message but another checksum on the Ruby file itself.

Noting the spurious - at the end, I'm thinking this might be an unexpected output format from the checksumming tool?

[thomasjo]

The checksum is calculated with either md5, openssl or md5sum and in that order depending on what is resolved successfully. Got any special alias that would perhaps alter the default output of either of those commands?

Update: corrected the misspelled md5 caused by my silly phone

[JamesHarrison]

Versions installed are as follows:

~  $  md5sum --version
md5sum (GNU coreutils) 8.22
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ulrich Drepper, Scott Miller, and David Madore.
 ~  $  openssl version
OpenSSL 1.0.1g 7 Apr 2014
 ~  $  md --version
-bash: md: command not found

No aliases defined that touch any of them.

[JamesHarrison]

Aha - looked in the source, and md5 is looked for before openssl. I have the md5 utility installed ( http://www.fourmilab.ch/md5/ via https://aur.archlinux.org/packages/md5/ ) which does not appear to be the same md5 utility that ruby-build is expecting (ruby-build passes a -q parameter, but the fourmilab md5 util does not accept one). Removing the md5 util from fourmilab fixes the issue.

Perhaps openssl should be preferred over the more generic utility name to reduce the probability of this happening? That or a more comprehensive check on the md5 utility in use, or processing of the output...

[thomasjo]

The md5 command expected by ruby-build is as far as I can tell, the one that ships with BSD variants, including OS X.

I have an open PR for swapping out the MD5 checksums with SHA2 checksums. If it gets accepted, it will fix this problem. Otherwise, I agree with you, the check needs to handle scenarios like this better.

[thomasjo]

Sorry about the confusion caused by the misspelled md5. It got autocorrected on my phone 😒

[JamesHarrison]

No worries - that all makes sense, figured md5 was likely the BSD variant but couldn't be sure without access to a Mac/BSD box. I'm clearly quite a niche case (ie, non-standard md5 installed) so I'll close this up (it's here for documentation if anyone else runs into it) and look forward to the SHA2 pull request being merged in.

[mislav]

Also see #532 (comment)