fix: add support for sha512-only archives

internal/archive/archive.go

@@ -139,8 +139,9 @@ func (a *ubuntuArchive) Fetch(pkg string) (io.ReadSeekCloser, *PackageInfo, erro
 		return nil, nil, err
 	}
 	path := section.Get("Filename")
+	digest, digestKind := packageDigest(section)
 	logf("Fetching %s...", path)
-	reader, err := index.fetch(path, section.Get("SHA256"), fetchBulk)
+	reader, err := index.fetch(path, digest, digestKind, fetchBulk)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -280,7 +281,9 @@ func openUbuntu(options *Options) (Archive, error) {
 
 func (index *ubuntuIndex) fetchRelease() error {
 	logf("Fetching %s %s %s suite details...", index.displayName(), index.version, index.suite)
-	reader, err := index.fetch(index.distPath("InRelease"), "", fetchDefault)
+	// InRelease has no digest to check against (it is verified by its PGP
+	// signature below), so the digest kind here is arbitrary.
+	reader, err := index.fetch(index.distPath("InRelease"), "", cache.SHA256, fetchDefault)
 	if err != nil {
 		return err
 	}
@@ -328,10 +331,46 @@ func (index *ubuntuIndex) fetchRelease() error {
 	return nil
 }
 
+// digestField is an archive checksum field Chisel can verify. Its name doubles
+// as the by-hash directory name in the archive layout.
+type digestField struct {
+	name string
+	kind cache.DigestKind
+}
+
+// digestFields lists the checksum fields Chisel can verify, in order of
+// preference. SHA256 is first so existing archives keep their cache keys;
+// Ubuntu 26.10 and later publish SHA512-only indices, handled by the fallback.
+var digestFields = []digestField{
+	{"SHA256", cache.SHA256},
+	{"SHA512", cache.SHA512},
+}
+
+// releaseDigest returns the checksum recorded for path in a Release "<hash>
+// <size> <path>" table, along with the field it was found in.
+func releaseDigest(release control.Section, path string) (digest string, field digestField) {
+	for _, f := range digestFields {
+		if d, _, ok := control.ParsePathInfo(release.Get(f.name), path); ok {
+			return d, f
+		}
+	}
+	return "", digestField{}
+}
+
+func packageDigest(section control.Section) (digest string, kind cache.DigestKind) {
+	for _, f := range digestFields {
+		if d := section.Get(f.name); d != "" {
+			return d, f.kind
+		}
+	}
+	// No digest advertised; fall back to SHA256 so the package can still be
+	// cached and retrieved by its computed digest.
+	return "", cache.SHA256
+}
+
 func (index *ubuntuIndex) fetchIndex() error {
-	releaseDigests := index.release.Get("SHA256")
 	packagesPath := fmt.Sprintf("%s/binary-%s/Packages", index.component, index.arch)
-	packagesDigest, _, _ := control.ParsePathInfo(releaseDigests, packagesPath)
+	packagesDigest, field := releaseDigest(index.release, packagesPath)
 	if packagesDigest == "" {
 		return fmt.Errorf("%s is missing from %s %s component digests", packagesPath, index.suite, index.component)
 	}
@@ -345,10 +384,10 @@ func (index *ubuntuIndex) fetchIndex() error {
 	packagesGzPath := packagesPath + ".gz"
 	var reader io.ReadSeekCloser
 	if index.release.Get("Acquire-By-Hash") == "yes" {
-		packagesGzDigest, _, _ := control.ParsePathInfo(releaseDigests, packagesGzPath)
+		packagesGzDigest, _, _ := control.ParsePathInfo(index.release.Get(field.name), packagesGzPath)
 		if packagesGzDigest != "" {
-			packagesByHashPath := fmt.Sprintf("%s/binary-%s/by-hash/SHA256/%s", index.component, index.arch, packagesGzDigest)
-			r, err := index.fetch(index.distPath(packagesByHashPath), packagesDigest, fetchBulk|fetchGzip)
+			packagesByHashPath := fmt.Sprintf("%s/binary-%s/by-hash/%s/%s", index.component, index.arch, field.name, packagesGzDigest)
+			r, err := index.fetch(index.distPath(packagesByHashPath), packagesDigest, field.kind, fetchBulk|fetchGzip)
 			if err != nil && err != errNotFound {
 				return err
 			}
@@ -358,7 +397,7 @@ func (index *ubuntuIndex) fetchIndex() error {
 		}
 	}
 	if reader == nil {
-		r, err := index.fetch(index.distPath(packagesGzPath), packagesDigest, fetchBulk|fetchGzip)
+		r, err := index.fetch(index.distPath(packagesGzPath), packagesDigest, field.kind, fetchBulk|fetchGzip)
 		if err != nil {
 			return err
 		}
@@ -399,8 +438,7 @@ func (index *ubuntuIndex) distPath(suffix string) string {
 	return "dists/" + index.suite + "/" + suffix
 }
 
-func (index *ubuntuIndex) fetch(path, digest string, flags fetchFlags) (io.ReadSeekCloser, error) {
-	const digestKind = cache.SHA256
+func (index *ubuntuIndex) fetch(path, digest string, digestKind cache.DigestKind, flags fetchFlags) (io.ReadSeekCloser, error) {
 	reader, err := index.archive.cache.Open(digestKind, digest)
 	if err == nil {
 		return reader, nil

internal/archive/archive_test.go

@@ -158,6 +158,16 @@ func (s *httpSuite) prepareArchiveAdjustRelease(suite, version, arch string, com
 	if adjustRelease != nil {
 		adjustRelease(release)
 	}
+	// Packages inherit the release's digest kind unless they set their own.
+	err = release.Walk(func(item testarchive.Item) error {
+		if p, ok := item.(*testarchive.Package); ok && p.Digest == "" {
+			p.Digest = release.Digest
+		}
+		return nil
+	})
+	if err != nil {
+		panic(err)
+	}
 	release.Render(base.Path, s.responses)
 	return release
 }
@@ -264,6 +274,32 @@ func (s *httpSuite) TestFetchPackage(c *C) {
 	c.Assert(read(pkg), Equals, "mypkg4 1.4 data")
 }
 
+func (s *httpSuite) TestFetchSHA512Digests(c *C) {
+	// Ubuntu 26.10+ publishes SHA512-only indices (no SHA256 section), so both
+	// the index digest and the package digest must be read from SHA512.
+	s.prepareArchiveAdjustRelease("stonking", "25.10", "amd64", []string{"main", "universe"},
+		func(release *testarchive.Release) {
+			release.Digest = "SHA512"
+		})
+
+	options := archive.Options{
+		Label:      "ubuntu",
+		Version:    "25.10",
+		Arch:       "amd64",
+		Suites:     []string{"stonking"},
+		Components: []string{"main", "universe"},
+		CacheDir:   c.MkDir(),
+		PubKeys:    []*packet.PublicKey{s.pubKey},
+	}
+
+	testArchive, err := archive.Open(&options)
+	c.Assert(err, IsNil)
+
+	pkg, _, err := testArchive.Fetch("mypkg1")
+	c.Assert(err, IsNil)
+	c.Assert(read(pkg), Equals, "mypkg1 1.1 data")
+}
+
 func (s *httpSuite) TestFetchPortsPackage(c *C) {
 
 	s.base = "http://ports.ubuntu.com/ubuntu-ports/"
@@ -687,6 +723,46 @@ func (s *httpSuite) TestFetchByHashSucceedsWhenNamedPathIsStale(c *C) {
 	c.Assert(status, Equals, 200)
 }
 
+func (s *httpSuite) TestFetchByHashSHA512(c *C) {
+	// Ubuntu 26.10+ advertises Acquire-By-Hash with SHA512-only indices, so
+	// the by-hash URL must be built under the SHA512 directory.
+	s.prepareArchiveAdjustRelease("stonking", "26.10", "amd64", []string{"main"}, func(release *testarchive.Release) {
+		release.ByHash = true
+		release.Digest = "SHA512"
+	})
+
+	// Stale content at the named Packages.gz path, so a fallback would fail
+	// the digest check -- only the by-hash path serves the correct bytes.
+	for p := range s.responses {
+		if strings.Contains(p, "Packages.gz") && !strings.Contains(p, "/by-hash/") {
+			s.responses[p] = testarchive.MakeGzip([]byte("stale Packages from previous publication"))
+		}
+	}
+
+	options := archive.Options{
+		Label:      "ubuntu",
+		Version:    "26.10",
+		Arch:       "amd64",
+		Suites:     []string{"stonking"},
+		Components: []string{"main"},
+		CacheDir:   c.MkDir(),
+		PubKeys:    []*packet.PublicKey{s.pubKey},
+	}
+
+	testArchive, err := archive.Open(&options)
+	c.Assert(err, IsNil)
+
+	pkg, _, err := testArchive.Fetch("mypkg1")
+	c.Assert(err, IsNil)
+	c.Assert(read(pkg), Equals, "mypkg1 1.1 data")
+
+	// The SHA512 by-hash request must have been attempted and succeeded;
+	// the named path only has stale content.
+	attempted, status := s.fetchRequestStatus("/by-hash/SHA512/")
+	c.Assert(attempted, Equals, true)
+	c.Assert(status, Equals, 200)
+}
+
 func (s *httpSuite) TestFetchByHashFallsBackOnNotFound(c *C) {
 	s.prepareArchiveAdjustRelease("jammy", "22.04", "amd64", []string{"main"}, func(r *testarchive.Release) {
 		r.ByHash = true

internal/archive/testarchive/testarchive.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"crypto/sha256"
+	"crypto/sha512"
 	"fmt"
 	"path"
 	"strings"
@@ -63,6 +64,8 @@ type Package struct {
 	Arch      string
 	Component string
 	Data      []byte
+	// Digest names the checksum field published for this package ("SHA256" when empty).
+	Digest string
 }
 
 func (p *Package) Path() string {
@@ -86,11 +89,11 @@ func (p *Package) Section() []byte {
 		Installed-Size: 10
 		Filename: %s
 		Size: %d
-		SHA256: %s
+		%s: %s
 		Description: Description of %s
 		Task: minimal
 
-	`)), p.Name, p.Arch, p.Version, p.Path(), len(content), makeSha256(content), p.Name)
+	`)), p.Name, p.Arch, p.Version, p.Path(), len(content), digestField(p.Digest), makeDigest(p.Digest, content), p.Name)
 	return []byte(section)
 }
 
@@ -107,6 +110,8 @@ type Release struct {
 	Label   string
 	Items   []Item
 	PrivKey *packet.PrivateKey
+	// Digest names the checksum field published for the index table ("SHA256" when empty).
+	Digest string
 	// ByHash enables the Acquire-By-Hash flag in the Release file
 	// and renders by-hash URLs alongside named paths.
 	ByHash bool
@@ -128,7 +133,7 @@ func (r *Release) Content() []byte {
 	digests := bytes.Buffer{}
 	for _, item := range r.Items {
 		content := item.Content()
-		fmt.Fprintf(&digests, " %s  %d  %s\n", makeSha256(content), len(content), item.Path())
+		fmt.Fprintf(&digests, " %s  %d  %s\n", makeDigest(r.Digest, content), len(content), item.Path())
 	}
 	acquireByHash := ""
 	if r.ByHash {
@@ -144,9 +149,9 @@ func (r *Release) Content() []byte {
 		Architectures: amd64 arm64 armhf i386 ppc64el riscv64 s390x
 		Components: main restricted universe multiverse
 		Description: Ubuntu %s
-		%sSHA256:
+		%s%s:
 		%s
-	`)), r.Label, r.Suite, r.Version, r.Version, acquireByHash, digests.String())
+	`)), r.Label, r.Suite, r.Version, r.Version, acquireByHash, digestField(r.Digest), digests.String())
 
 	var buf bytes.Buffer
 	writer, err := clearsign.Encode(&buf, r.PrivKey, nil)
@@ -175,7 +180,7 @@ func (r *Release) Render(prefix string, content map[string][]byte) error {
 		distItemPath := path.Join(prefix, "dists", r.Suite, itemPath)
 		content[distItemPath] = itemContent
 		if r.ByHash && itemPath != r.Path() {
-			byHashPath := path.Join(prefix, "dists", r.Suite, path.Dir(itemPath), "by-hash", "SHA256", makeSha256(itemContent))
+			byHashPath := path.Join(prefix, "dists", r.Suite, path.Dir(itemPath), "by-hash", digestField(r.Digest), makeDigest(r.Digest, itemContent))
 			content[byHashPath] = itemContent
 		}
 		return nil
@@ -216,6 +221,22 @@ func makeSha256(b []byte) string {
 	return fmt.Sprintf("%x", sha256.Sum256(b))
 }
 
+// digestField maps a digest kind to its Release/Packages field name, defaulting
+// to SHA256.
+func digestField(kind string) string {
+	if kind == "" {
+		return "SHA256"
+	}
+	return kind
+}
+
+func makeDigest(kind string, b []byte) string {
+	if kind == "SHA512" {
+		return fmt.Sprintf("%x", sha512.Sum512(b))
+	}
+	return makeSha256(b)
+}
+
 func MakeGzip(b []byte) []byte {
 	var buf bytes.Buffer
 	gz := gzip.NewWriter(&buf)

internal/cache/cache.go

@@ -2,6 +2,7 @@ package cache
 
 import (
 	"crypto/sha256"
+	"crypto/sha512"
 	"encoding/hex"
 	"fmt"
 	"hash"
@@ -96,9 +97,10 @@ type DigestKind string
 const (
 	SHA256 DigestKind = "sha256"
 	SHA384 DigestKind = "sha384"
+	SHA512 DigestKind = "sha512"
 )
 
-var digestKinds = []DigestKind{SHA256, SHA384}
+var digestKinds = []DigestKind{SHA256, SHA384, SHA512}
 
 var ErrMiss = fmt.Errorf("not cached")
 
@@ -117,6 +119,8 @@ func (c *Cache) Create(digestKind DigestKind, digest string) *Writer {
 		h = sha256.New()
 	case SHA384:
 		h = sha3.New384()
+	case SHA512:
+		h = sha512.New()
 	default:
 		return &Writer{err: fmt.Errorf("internal error: unsupported digest kind: %q", digestKind)}
 	}