From: Pádraig Brady <P@draigBrady.com>
Date: Mon, 6 Oct 2025 12:23:55 +0000 (+0100)
Subject: cksum: fix --check with --algorithm=sha2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cd2a8edd84a6b6a17ba1b788a6b3930c5a4d590e;p=thirdparty%2Fcoreutils.git

cksum: fix --check with --algorithm=sha2

* src/digest.c (split_3): Look up the provided tag with -a sha2
because there is not a 1:1 mapping between them.
* tests/cksum/cksum-c.sh: Add a test case.
* NEWS: Mention the bug fix.
---

diff --git a/NEWS b/NEWS
index d5946ced93..e1c161d96c 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,10 @@ GNU coreutils NEWS                                    -*- outline -*-
   for all length adjustable algorithms (blake2b, sha2, sha3).
   [bug introduced in coreutils-9.2]
 
+  'cksum --check -a sha2' now supports tagged format.
+  '-a sha2' is not required with tagged format, but should be accepted.
+  [bug introduced in coreutils-9.8]
+
   'rm -d DIR' no longer fails on Ceph snapshot directories.
   Although these directories are nonempty, 'rmdir DIR' succeeds on them.
   [bug introduced in coreutils-8.16]
diff --git a/src/digest.c b/src/digest.c
index 13b1667950..86119b5ab3 100644
--- a/src/digest.c
+++ b/src/digest.c
@@ -843,16 +843,20 @@ split_3 (char *s, size_t s_len,
   /* Check for BSD-style checksum line. */
 
 #if HASH_ALGO_CKSUM
-  if (! algorithm_specified)
+  if (! algorithm_specified || cksum_algorithm == sha2)
     {
       ptrdiff_t algo_tag = algorithm_from_tag (s + i);
       if (algo_tag >= 0)
         {
           if (algo_tag <= crc32b)
             return false;  /* We don't support checking these older formats.  */
+          if (cksum_algorithm == sha2 && algo_tag != sha2
+              && algo_tag != sha224 && algo_tag != sha256
+              && algo_tag != sha384 && algo_tag != sha512)
+            return false;  /* Wrong tag for -a sha2.  */
           cksum_algorithm = algo_tag;
         }
-      else
+      else if (! algorithm_specified)
         return false;  /* We only support tagged format without -a.  */
     }
 #endif
diff --git a/tests/cksum/cksum-c.sh b/tests/cksum/cksum-c.sh
index 95ceb4f334..9e08bddeb0 100755
--- a/tests/cksum/cksum-c.sh
+++ b/tests/cksum/cksum-c.sh
@@ -26,10 +26,15 @@ for args in '-a sha2 -l 384' '-a blake2b' '-a blake2b -l 384' '-a sm3'; do
 done
 cksum --strict --check CHECKSUMS || fail=1
 
-# We don't output but do support SHA2-### tagged format
-cksum -a sha2 -l 384 input |
-  sed 's/^SHA/SHA2-/' > sha2-tag.sum || framework_failure_
-cksum --check sha2-tag.sum || fail=1
+# We don't output but do support SHA2-### tagged format.
+# Also ensure we check both formats with and without -a specified.
+cksum -a sha2 -l 384 input > sha384-tag.sum || framework_failure_
+sed 's/^SHA/SHA2-/' sha384-tag.sum > sha2-tag.sum || framework_failure_
+for file in sha384-tag.sum sha2-tag.sum; do
+  for spec in '' '-a sha2'; do
+    cksum --check $spec $file || fail=1
+  done
+done
 
 # Ensure leading whitespace and \ ignored
 sed 's/^/ \\/' CHECKSUMS | cksum --strict -c || fail=1