fix: add support for sha512-only archives

internal/archive/archive.go

@@ -139,8 +139,9 @@ func (a *ubuntuArchive) Fetch(pkg string) (io.ReadSeekCloser, *PackageInfo, erro
 		return nil, nil, err
 	}
 	path := section.Get("Filename")
+	digest, digestKind := packageDigest(section)
 	logf("Fetching %s...", path)
-	reader, err := index.fetch(path, section.Get("SHA256"), fetchBulk)
+	reader, err := index.fetch(path, digest, digestKind, fetchBulk)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -280,7 +281,9 @@ func openUbuntu(options *Options) (Archive, error) {
 
 func (index *ubuntuIndex) fetchRelease() error {
 	logf("Fetching %s %s %s suite details...", index.displayName(), index.version, index.suite)
-	reader, err := index.fetch(index.distPath("InRelease"), "", fetchDefault)
+	// InRelease has no digest to check against (it is verified by its PGP
+	// signature below), so the digest kind here is arbitrary.
+	reader, err := index.fetch(index.distPath("InRelease"), "", cache.SHA256, fetchDefault)
 	if err != nil {
 		return err
 	}
@@ -328,10 +331,57 @@ func (index *ubuntuIndex) fetchRelease() error {
 	return nil
 }
 
+// digestField is an archive checksum field Chisel can verify. Its name
+// doubles as the by-hash directory name in the archive layout.
+type digestField struct {
+	name string
+	kind cache.DigestKind
+}
+
+// digestFields lists the checksum fields Chisel can verify, strongest first.
+// This order matches the by-hash archive layout: an archive is only guaranteed
+// to publish a by-hash directory for the strongest hash it advertises.
+var digestFields = []digestField{
+	{"SHA512", cache.SHA512},
+	{"SHA256", cache.SHA256},
+}
+
+// cacheDigestFields is digestFields reordered to prefer SHA256, so that
+// existing caches keep their keys. It picks the digest used to verify content
+// and key the cache, and nothing else.
+// TODO Drop this in favour of digestFields. That changes cache keys for
+// archives publishing both digests, so it must wait for a minor release.
+var cacheDigestFields = []digestField{
+	{"SHA256", cache.SHA256},
+	{"SHA512", cache.SHA512},
+}
+
+// findDigest returns the checksum recorded for path in a Release "<hash>
+// <size> <path>" table, along with the field it was found in, trying the
+// fields in order.
+func findDigest(release control.Section, path string, order []digestField) (digest string, field digestField) {
+	for _, f := range order {
+		if d, _, ok := control.ParsePathInfo(release.Get(f.name), path); ok {
+			return d, f
+		}
+	}
+	return "", digestField{}
+}
+
+func packageDigest(section control.Section) (digest string, kind cache.DigestKind) {
+	for _, f := range cacheDigestFields {
+		if d := section.Get(f.name); d != "" {
+			return d, f.kind
+		}
+	}
+	// No digest advertised; fall back to SHA256 so the package can still be
+	// cached and retrieved by its computed digest.
+	return "", cache.SHA256
+}
+
 func (index *ubuntuIndex) fetchIndex() error {
-	releaseDigests := index.release.Get("SHA256")
 	packagesPath := fmt.Sprintf("%s/binary-%s/Packages", index.component, index.arch)
-	packagesDigest, _, _ := control.ParsePathInfo(releaseDigests, packagesPath)
+	packagesDigest, cacheField := findDigest(index.release, packagesPath, cacheDigestFields)
 	if packagesDigest == "" {
 		return fmt.Errorf("%s is missing from %s %s component digests", packagesPath, index.suite, index.component)
 	}
@@ -345,10 +395,15 @@ func (index *ubuntuIndex) fetchIndex() error {
 	packagesGzPath := packagesPath + ".gz"
 	var reader io.ReadSeekCloser
 	if index.release.Get("Acquire-By-Hash") == "yes" {
-		packagesGzDigest, _, _ := control.ParsePathInfo(releaseDigests, packagesGzPath)
+		// By-hash directories are only guaranteed to exist for the strongest
+		// hash the archive advertises, so the URL is built from the strongest
+		// field, independently of the digest used for verification and the
+		// cache. If the archive advertises a hash stronger than any Chisel
+		// knows, the URL may 404 and the named-path fallback below applies.
+		packagesGzDigest, byHashField := findDigest(index.release, packagesGzPath, digestFields)
 		if packagesGzDigest != "" {
-			packagesByHashPath := fmt.Sprintf("%s/binary-%s/by-hash/SHA256/%s", index.component, index.arch, packagesGzDigest)
-			r, err := index.fetch(index.distPath(packagesByHashPath), packagesDigest, fetchBulk|fetchGzip)
+			packagesByHashPath := fmt.Sprintf("%s/binary-%s/by-hash/%s/%s", index.component, index.arch, byHashField.name, packagesGzDigest)
+			r, err := index.fetch(index.distPath(packagesByHashPath), packagesDigest, cacheField.kind, fetchBulk|fetchGzip)
 			if err != nil && err != errNotFound {
 				return err
 			}
@@ -358,7 +413,7 @@ func (index *ubuntuIndex) fetchIndex() error {
 		}
 	}
 	if reader == nil {
-		r, err := index.fetch(index.distPath(packagesGzPath), packagesDigest, fetchBulk|fetchGzip)
+		r, err := index.fetch(index.distPath(packagesGzPath), packagesDigest, cacheField.kind, fetchBulk|fetchGzip)
 		if err != nil {
 			return err
 		}
@@ -399,8 +454,7 @@ func (index *ubuntuIndex) distPath(suffix string) string {
 	return "dists/" + index.suite + "/" + suffix
 }
 
-func (index *ubuntuIndex) fetch(path, digest string, flags fetchFlags) (io.ReadSeekCloser, error) {
-	const digestKind = cache.SHA256
+func (index *ubuntuIndex) fetch(path, digest string, digestKind cache.DigestKind, flags fetchFlags) (io.ReadSeekCloser, error) {
 	reader, err := index.archive.cache.Open(digestKind, digest)
 	if err == nil {
 		return reader, nil

internal/archive/archive_test.go

@@ -129,10 +129,11 @@ func (s *httpSuite) prepareArchive(suite, version, arch string, components []str
 
 func (s *httpSuite) prepareArchiveAdjustRelease(suite, version, arch string, components []string, adjustRelease func(*testarchive.Release)) *testarchive.Release {
 	release := &testarchive.Release{
-		Suite:   suite,
-		Version: version,
-		Label:   "Ubuntu",
-		PrivKey: s.privKey,
+		Suite:       suite,
+		Version:     version,
+		Label:       "Ubuntu",
+		PrivKey:     s.privKey,
+		DigestKinds: []string{"SHA256"},
 	}
 	for i, component := range components {
 		index := &testarchive.PackageIndex{
@@ -158,7 +159,10 @@ func (s *httpSuite) prepareArchiveAdjustRelease(suite, version, arch string, com
 	if adjustRelease != nil {
 		adjustRelease(release)
 	}
-	release.Render(base.Path, s.responses)
+	err = release.Render(base.Path, s.responses)
+	if err != nil {
+		panic(err)
+	}
 	return release
 }
 
@@ -264,6 +268,70 @@ func (s *httpSuite) TestFetchPackage(c *C) {
 	c.Assert(read(pkg), Equals, "mypkg4 1.4 data")
 }
 
+func (s *httpSuite) TestFetchSHA512Digests(c *C) {
+	// Ubuntu 26.10+ publishes SHA512-only indices (no SHA256 section), so both
+	// the index digest and the package digest must be read from SHA512.
+	s.prepareArchiveAdjustRelease("stonking", "25.10", "amd64", []string{"main", "universe"},
+		func(release *testarchive.Release) {
+			release.DigestKinds = []string{"SHA512"}
+		})
+
+	options := archive.Options{
+		Label:      "ubuntu",
+		Version:    "25.10",
+		Arch:       "amd64",
+		Suites:     []string{"stonking"},
+		Components: []string{"main", "universe"},
+		CacheDir:   c.MkDir(),
+		PubKeys:    []*packet.PublicKey{s.pubKey},
+	}
+
+	testArchive, err := archive.Open(&options)
+	c.Assert(err, IsNil)
+
+	pkg, _, err := testArchive.Fetch("mypkg1")
+	c.Assert(err, IsNil)
+	c.Assert(read(pkg), Equals, "mypkg1 1.1 data")
+}
+
+func (s *httpSuite) TestFetchBothDigests(c *C) {
+	// An archive publishing both SHA256 and SHA512 sections (index table and
+	// package fields) must be handled, with SHA256 preferred per the cache
+	// ordering -- so PackageInfo.SHA256 is the field that surfaces.
+	s.prepareArchiveAdjustRelease("stonking", "25.10", "amd64", []string{"main", "universe"},
+		func(release *testarchive.Release) {
+			release.DigestKinds = []string{"SHA256", "SHA512"}
+		})
+
+	options := archive.Options{
+		Label:      "ubuntu",
+		Version:    "25.10",
+		Arch:       "amd64",
+		Suites:     []string{"stonking"},
+		Components: []string{"main", "universe"},
+		CacheDir:   c.MkDir(),
+		PubKeys:    []*packet.PublicKey{s.pubKey},
+	}
+
+	testArchive, err := archive.Open(&options)
+	c.Assert(err, IsNil)
+
+	pkg, info, err := testArchive.Fetch("mypkg1")
+	c.Assert(err, IsNil)
+	c.Assert(info, DeepEquals, &archive.PackageInfo{
+		Name:    "mypkg1",
+		Version: "1.1",
+		Arch:    "amd64",
+		SHA256:  "1f08ef04cfe7a8087ee38a1ea35fa1810246648136c3c42d5a61ad6503d85e05",
+	})
+	c.Assert(read(pkg), Equals, "mypkg1 1.1 data")
+
+	// Pin the cache key: with both digests advertised, packages must stay
+	// cached under their SHA256 so existing caches keep their entries.
+	_, err = os.Stat(filepath.Join(options.CacheDir, "sha256", info.SHA256))
+	c.Assert(err, IsNil)
+}
+
 func (s *httpSuite) TestFetchPortsPackage(c *C) {
 
 	s.base = "http://ports.ubuntu.com/ubuntu-ports/"
@@ -310,14 +378,16 @@ func (s *httpSuite) TestFetchSecurityPackage(c *C) {
 
 	for i, suite := range []string{"jammy", "jammy-updates", "jammy-security"} {
 		release := s.prepareArchive(suite, "22.04", "amd64", []string{"main", "universe"})
-		release.Walk(func(item testarchive.Item) error {
+		err := release.Walk(func(item testarchive.Item) error {
 			if p, ok := item.(*testarchive.Package); ok && p.Name == "mypkg1" {
 				p.Version = fmt.Sprintf("%s.%d", p.Version, i)
 				p.Data = []byte("package from " + suite)
 			}
 			return nil
 		})
-		release.Render("/ubuntu", s.responses)
+		c.Assert(err, IsNil)
+		err = release.Render("/ubuntu", s.responses)
+		c.Assert(err, IsNil)
 	}
 
 	options := archive.Options{
@@ -687,6 +757,89 @@ func (s *httpSuite) TestFetchByHashSucceedsWhenNamedPathIsStale(c *C) {
 	c.Assert(status, Equals, 200)
 }
 
+func (s *httpSuite) TestFetchByHashSHA512(c *C) {
+	// Ubuntu 26.10+ advertises Acquire-By-Hash with SHA512-only indices, so
+	// the by-hash URL must be built under the SHA512 directory.
+	s.prepareArchiveAdjustRelease("stonking", "26.10", "amd64", []string{"main"}, func(release *testarchive.Release) {
+		release.ByHash = true
+		release.DigestKinds = []string{"SHA512"}
+	})
+
+	// Stale content at the named Packages.gz path, so a fallback would fail
+	// the digest check -- only the by-hash path serves the correct bytes.
+	for p := range s.responses {
+		if strings.Contains(p, "Packages.gz") && !strings.Contains(p, "/by-hash/") {
+			s.responses[p] = testarchive.MakeGzip([]byte("stale Packages from previous publication"))
+		}
+	}
+
+	options := archive.Options{
+		Label:      "ubuntu",
+		Version:    "26.10",
+		Arch:       "amd64",
+		Suites:     []string{"stonking"},
+		Components: []string{"main"},
+		CacheDir:   c.MkDir(),
+		PubKeys:    []*packet.PublicKey{s.pubKey},
+	}
+
+	testArchive, err := archive.Open(&options)
+	c.Assert(err, IsNil)
+
+	pkg, _, err := testArchive.Fetch("mypkg1")
+	c.Assert(err, IsNil)
+	c.Assert(read(pkg), Equals, "mypkg1 1.1 data")
+
+	// The SHA512 by-hash request must have been attempted and succeeded;
+	// the named path only has stale content.
+	attempted, status := s.fetchRequestStatus("/by-hash/SHA512/")
+	c.Assert(attempted, Equals, true)
+	c.Assert(status, Equals, 200)
+}
+
+func (s *httpSuite) TestFetchByHashBothDigests(c *C) {
+	// When a by-hash archive publishes both digests, the by-hash URL must be
+	// built under SHA512: archives only guarantee a by-hash directory for the
+	// strongest hash they advertise. SHA256 by-hash must not be requested.
+	s.prepareArchiveAdjustRelease("stonking", "26.10", "amd64", []string{"main"}, func(release *testarchive.Release) {
+		release.ByHash = true
+		release.DigestKinds = []string{"SHA256", "SHA512"}
+	})
+
+	// Stale content at the named Packages.gz path, so a fallback would fail
+	// the digest check -- only the by-hash path serves the correct bytes.
+	for p := range s.responses {
+		if strings.Contains(p, "Packages.gz") && !strings.Contains(p, "/by-hash/") {
+			s.responses[p] = testarchive.MakeGzip([]byte("stale Packages from previous publication"))
+		}
+	}
+
+	options := archive.Options{
+		Label:      "ubuntu",
+		Version:    "26.10",
+		Arch:       "amd64",
+		Suites:     []string{"stonking"},
+		Components: []string{"main"},
+		CacheDir:   c.MkDir(),
+		PubKeys:    []*packet.PublicKey{s.pubKey},
+	}
+
+	testArchive, err := archive.Open(&options)
+	c.Assert(err, IsNil)
+
+	pkg, _, err := testArchive.Fetch("mypkg1")
+	c.Assert(err, IsNil)
+	c.Assert(read(pkg), Equals, "mypkg1 1.1 data")
+
+	// The SHA512 by-hash request must have been made and succeeded; the SHA256
+	// by-hash directory must never be touched.
+	attempted, status := s.fetchRequestStatus("/by-hash/SHA512/")
+	c.Assert(attempted, Equals, true)
+	c.Assert(status, Equals, 200)
+	attempted, _ = s.fetchRequestStatus("/by-hash/SHA256/")
+	c.Assert(attempted, Equals, false)
+}
+
 func (s *httpSuite) TestFetchByHashFallsBackOnNotFound(c *C) {
 	s.prepareArchiveAdjustRelease("jammy", "22.04", "amd64", []string{"main"}, func(r *testarchive.Release) {
 		r.ByHash = true