I was (am) having trouble installing Eagle on my Linux (debian 8 jessie) computer. I was reading the installer script, when i noticed there is a checksum for the install script in the install script?

I modified 1 character in the script, in a comment, and suddenly I was getting

Checksum error in './eagle-lin-7.2.0.run'

How does that work? Wouldn't you need to know the checksum before putting it in the script? It seems paradoxical to me. Can someone please explain how a checksum for the entire script can be placed in the script?

This particular checksum is MD5.

  • If you can make a Quine, I'd guess might be possible. Related: stackoverflow.com/questions/2193993/… (in particular the last section of the second answer) – muru Jan 9 '15 at 4:24
  • 1
    learning some new words... – Kero Poonk Jan 9 '15 at 4:27
  • 2
    How exactly have you modified the script ? The checksum is for the archive that follows the script (everything after the line __DATA__) so I don't see how modifying the script itself would have any effect on archive checksum. I just downloaded the installer and deleted all commented lines from the script with sed -i and it installed fine afterwards. – don_crissti Jan 9 '15 at 6:02
  • 1
    @muru No, you can't make a script that contains its own cryptographic hash. It's possible, mathematically speaking, but actually finding one would require to run all the computers now on Earth for longer than the universe has existed. – Gilles Jan 9 '15 at 22:21
  • 1
    When calculating the hash, you can ignore the line that contains the hash. E.g. CALC=$(grep -v CHECKSUM= $0 | md5sum) – Barmar Jan 9 '15 at 22:53

I downloaded this installer and took a peek. Here are the relevant code snippets:



# The required tools:
DATA="$SED -e '1,/^__DATA__$/d' '$0'"

# Check archive integrity:
test `eval $DATA | $MD5SUM | $CUT -d " " -f 1` = $MD5 || {
  echo "Checksum error in '$0'" >&2
  exit 1

# ...

exit 0
# Everything after the next line is a .tar.bz2 file
[a binary blob finishes the file]

This runs sed -e '1,/^__DATA__$/d' on the script itself, which deletes all lines from the beginning (line 1) to the __DATA__ line, leaving just the binary behind. The binary is then run through md5sum to get the checksum, cut then formats it to contain just the checksum itself (no filename), and then it is compared to the hard-coded checksum from earlier in the script.

The test statement returns true when the MD5 matches and false when it does not match. The || will short-circuit when the test is true, meaning it stops evaluation. The bracketed stanza will only run when the test is false.

Since you likely didn't (intentionally) touch anything after that __DATA__ line, it's probably your text editor's fault. I suspect it added a space or blank line or it converted between DOS and UNIX line formats (learn more about newlines at Wikipedia).

Another possibility is that the download failed and you have a corrupted file. If this is not a concern, merely remove the exit 1 line from that MD5 test stanza and the installer should work just fine.

(This script is not well written, so I am not at all surprised that you had to modify it to make it work.)

Your Answer

