I have a problem that brings me to despair and is plaguing me for the last days and I hope somebody can give me a hint what I have overlooked, since bash/sh is not a field I work in everyday:
Scenario: I have a project developed in OS X 10.11.6, that gets packed into a tar file and a sha 256 checksum is calculated of this tar file.
On the git pre-commit hook I add the calulated checksum in a .sha file to the repository, so that another system that wants to install that project can compare if the files are the same by also packing the file into a tar file and calculation the checksum and comparing it to the .sha checksum from the directory. If those checksums are the same, the version of this package is "verified" and valid for the end user, if not, a warning is displayed.
So the pre-commit hook and the checksum.sh files basically do the same, except the first adds the calculated checksum to the repository.
I use the same tar utility on both systems, (GNU) tar 1.28 on Ubuntu (tried it with 1.30 aswell, no difference) and gtar (gnu-tar) 1.30 on OS X.
Problem: I get different checksums on OS X than on Ubuntu (16.04 in Virtualbox) even though pkgdiff / diffMerge / filemerge (OS X) show no differences in any files and I exclude and normalize a bunch of stuff when building the tar, excluding any git parts, temporary files, post-install directories, weirdly inconsistent npm files (see my other question here: npm install different package-lock) and the .sha/sha.tar files themselves as well as normalizing the modification time and setting the owner:group to root:root.
When I compare an Ubuntu-built tar archive to an OS X built with pkgdiff I see no differences, with FileMerge on OSX there is a bunch of obfuscated(?) and rearranged code, which I suspect could be the problem, since I'm comparing the checksum of those tar archives later but I can't figure what is the source of this difference.
System 1 - OS X: 10.11.6, gtar 1.30, git v 2.10.1 System 2 - Ubuntu 16.04 LTS, tar 1.28 (and tar 1.30), git 2.74
I would be very happy if somebody has some expertise on this matter and would help a fellow developer to solve this issue, but I am grateful for any input - thanks in advance!
My checksum.sh looks basically like this:
unameOut="$(uname -s)"
case "${unameOut}" in
Linux*) tar --mtime='2017-01-01' --exclude='.sha' --exclude='*.git' --exclude='.DS_Store' --exclude='node_modules' --exclude='package-lock.json' --exclude='workstation.json' --exclude="npm-debug.log" --exclude-vcs --exclude=".gitignore" --exclude="sha.tar" --owner=0 --group=0 -cf ./sha.tar ./ 2>/dev/null;
sha256sum ./sha.tar | cut -d " " -f 1 > .sha_temp_check;;
Darwin*) command -v gtar >/dev/null 2>&1 || { echo >&2 "On MacOS gnu compatible TAR is needed, please install gtar via homebrew \n -> brew install gnu-tar ('xcode-select --install' maybe also needed)!\n…Aborting."; exit 1; };
gtar --mtime='2017-01-01' --exclude='.sha' --exclude='*.git' --exclude='.DS_Store' --exclude='node_modules' --exclude='package-lock.json' --exclude='workstation.json' --exclude="npm-debug.log" --exclude-vcs --exclude=".gitignore" --exclude="sha.tar" --owner=0 --group=0 -cf ./sha.tar ./ 2>/dev/null;
shasum -a 256 ./sha.tar | cut -d " " -f 1 > .sha_temp_check;;
# CYGWIN*) machine=Cygwin;;
# MINGW*) machine=MinGw;;
*) echo >&2 "Incompatible OS: ${unameOut} \n…Aborting."; exit 1;;
esac
rm sha.tar
stored_sha=$(cat .sha)
checked_sha=$(cat .sha_temp_check)
echo "STORED checksum: $stored_sha"
echo "CALC'D checksum: $checked_sha"
if [ "$checked_sha" = "$stored_sha" ]
then
echo >&1 "Version verified. Continuing. "
rm .sha_temp_check
exit 0
else
echo >&2 "Keys didn't match. UNVERIFIED VERSION! \n Stored SHA: $stored_sha \n Checked SHA: $checked_sha"
rm .sha_temp_check
exit 1
fi
