Checksum verification fails

[Arthur-DTAG]

Hi, i downloaded the Windows Desktop Version and the corresponding .yml file. After, i created the sha512 checksum of the .exe unfortunately, the checksums do not match. Same for the other Desktop releases (Linux, MacOS).

Do I need to encode the result after Hashing or something?

Thanks!

[jgadsden]

Hello @Arthur-DTAG , a very good question! I realise that I have not put the instructions into the release notes.

We have to have the latest*.yml files in place, and in this format, for the electron auto updates to work for the desktop version.
The sha512s are in binary format that is base64 encoded - which I agree is not very human readable :)

To get the command line sha512 there is a handy bash script (I am not sure of the windows one) eg for linux sha512:
grep sha512 latest-linux.yml | tail -n 1 | cut -d " " -f 2 | base64 -d | hexdump -ve '1/1 "%.2x"'

which for the 2.1.1 Windows msi latest.yml installer :

version: 2.1.1
files:
  - url: Threat-Dragon-ng-Setup-2.1.1.exe
    sha512: 48hPUsfvz23ebA0FrgUFR+0G+iYlGG1jsFj2sKVaI85TNhr+YcGUpPfAcQ4RoCp57fa5c+uv60lsQs/+1WGu5Q==
    size: 144050992
path: Threat-Dragon-ng-Setup-2.1.1.exe
sha512: 48hPUsfvz23ebA0FrgUFR+0G+iYlGG1jsFj2sKVaI85TNhr+YcGUpPfAcQ4RoCp57fa5c+uv60lsQs/+1WGu5Q==
releaseDate: '2023-10-31T08:24:39.532Z'

gives:

% grep sha512 latest.yml | tail -n 1 | cut -d " " -f 2 | base64 -d |  hexdump -ve '1/1 "%.2x"'
e3c84f52c7efcf6dde6c0d05ae050547ed06fa2625186d63b058f6b0a55a23ce53361afe61c194a4f7c0710e11a02a79edf6b973ebafeb496c42cffed561aee5

which compares to:

% sha512sum Threat-Dragon-ng-Setup-2.1.1.exe 
e3c84f52c7efcf6dde6c0d05ae050547ed06fa2625186d63b058f6b0a55a23ce53361afe61c194a4f7c0710e11a02a79edf6b973ebafeb496c42cffed561aee5  Threat-Dragon-ng-Setup-2.1.1.exe

[jgadsden]

and none of this is very obvious ... so maybe I should just provide the checksums and save everybody the bother

[Arthur-DTAG]

Great explanation, thanks!

[jgadsden]

I have updated the release notes, via Commit c3c6577, if that is sufficient?
I thought that if we manually edited shasums then it was bound to go wrong, but I am not sure if bash scripts work OK on Windows machines

[Arthur-DTAG]

Yeah - I definetely know what to do now.

Best would be if the hash would be "plain" sha512 in future but this seems to be limited by the lib as far as i see. :)