"Verifying staged files" is soooo sloooooooooooooow

Lucapz · February 15, 2020, 8:40am

“Verifying staged files” is really slow.

Can’t clearlinux add an option to the installer for lower powered computer or laptops for checking the files with a lower sha256sum to speed things up?

I’m all for security but that seems a bit over the top for your average home user , i can’t think of any other distro that spends that amount of time hash checking.

ahkok · February 16, 2020, 6:57am

github.com

clearlinux/swupd-client/blob/86786b94cacdd18cf1245bdda29f23e8a3e271dc/src/hash.c#L84


      
          	unsigned int digest_len = 0;
          	char *digest_str;
          	size_t digest_str_len;
          	unsigned int i;
          
          
	if (data == NULL) {
          		hash_set_zeros(hash);
          		return;
          	}
          
          
	if (HMAC(EVP_sha256(), (const void *)key, key_len, data, data_len, digest, &digest_len) == NULL) {
          		hash_set_zeros(hash);
          		return;
          	}
          
          
	digest_str_len = MAX((digest_len * 2) + 1, SWUPD_HASH_LEN);
          	digest_str = calloc(digest_str_len, sizeof(char));
          	ON_NULL_ABORT(digest_str);
          
          
	for (i = 0; i < digest_len; i++) {
          		snprintf(&digest_str[i * 2], digest_str_len, "%02x", (unsigned int)digest[i]);

swupd and tools use a SHA256 hash function.

We can not and will not go lower, as this would compromise security beyond a reasonable level.

Unfortunately, while it “seems” over the top, it absolutely is not.

Lucapz · February 16, 2020, 8:53am

My comment about it being over the top wasn’t articulated very well as i wrongly assumed it was using sha512 as i’ve never seen a distro hash that slow or for that length of time, i didn’t realize it was already using sha256.