sha_cmd() discards sys:run() error, masks real failure as 'sha256sum not found' #54

New issue

Open

opened 2026-08-16 06:28:58 +02:00 by michael · 0 comments

michael commented

2026-08-16 06:28:58 +02:00

Owner

Problem

In crypto/hash.lua's sha_cmd(), the error result of the detection
command is silently discarded:

local out = sys:run("command -v sha256sum")
local found = out and out:match("%S+") or nil
_cmd = found and "sha256sum" or "sha256 -r"

A genuine execution failure of sys:run() (e.g. shell unavailable)
is indistinguishable from "sha256sum not installed" -- both silently
fall through to the BSD (sha256 -r) branch.

Found while reviewing the daw_i18n/v1 migration of crypto/hash.lua
(DAW/daw-lua-common#48). Not an i18n issue, and out of scope for #48.

Scope

Decide whether sys:run()'s error result should be inspected before
falling back to the BSD command, and if so, how a genuine execution
failure should be surfaced vs. "tool not found"

DAW/daw-lua-common#48

## Problem In crypto/hash.lua's sha_cmd(), the error result of the detection command is silently discarded: ```lua local out = sys:run("command -v sha256sum") local found = out and out:match("%S+") or nil _cmd = found and "sha256sum" or "sha256 -r" ``` A genuine execution failure of `sys:run()` (e.g. shell unavailable) is indistinguishable from "sha256sum not installed" -- both silently fall through to the BSD (`sha256 -r`) branch. Found while reviewing the daw_i18n/v1 migration of crypto/hash.lua (DAW/daw-lua-common#48). Not an i18n issue, and out of scope for #48. ## Scope - Decide whether sys:run()'s error result should be inspected before falling back to the BSD command, and if so, how a genuine execution failure should be surfaced vs. "tool not found" ## Related DAW/daw-lua-common#48

michael added the

labels

2026-08-16 06:28:58 +02:00