Bug#684520: debootstrap: package validation fails when running on Android+busybox
Package: debootstrap
Version: 1.0.42
Severity: normal
Tags: upstream
https://github.com/guardianproject/lildebi
When using debootstrap 1.0.42 in the Android app Lil' Debi, it runs, gets
the Release info, then starts downloading packages, but then fails on
validation. It seems to be failing in verify_checksum() but we're not
positive about that. The failure seems to be caused by the wrong checksums
being compared, here's a debug print:
I: Validation failed: 250368, 250368, edfaffdb7beea7e0e5db61c3b1b210e9, fc4c586d12c9e5e16edc707ec920f2f2e7122689e206fda78374886e7aecfaba
This app provides gpgv and debian-archive-keyring.gpg so it should be fully
verified. That part is not well tested, but running without --keyring has been
tested a lot. This seems to work fine in 1.0.26+squeeze1
The Android app provides its own custom busybox 1.20.2 to provide the complete
environment with all commands that debootstrap uses. debootstrap is also run
in busybox's sh rather than the very minimal Android sh.
This validaton failure doesn't happen with debootstrap 1.0.26+squeeze1 and
we have made lots of successful chroots using debootstrap 1.0.26+squeeze1 on
Android. There is another Android app that also uses debootstrap
1.0.26+squeeze1 successfully: http://android.galoula.com/en/LinuxInstall/
You can find our discussion of this bug here:
https://github.com/guardianproject/lildebi/issues/27
-- System Information:
Architecture: armel
Reply to: