dehydrated-io / dehydrated

letsencrypt/acme client implemented as a shell-script – just add water
https://dehydrated.io
MIT License
5.96k stars 716 forks source link

`hexdump` is a linux only tool #910

Open drboone opened 1 year ago

drboone commented 1 year ago

The hexdump command is linux-only, and apparently comes from the util-linux command. Something that is available on other platforms would be a better choice. I haven't followed my way through the script to figure out where all it uses this, so I don't know what features and formats are required. I do know that dehydrated has been working flawlessly on my Illumos-derived systems for years without hexdump installed. Maybe xxd would work? That seems to be widely available.

lukas2511 commented 1 year ago

Mh.. that's news to me. Hexdump also exists on MacOS and FreeBSD, and a lot of other systems, I'd also assume that it's available on Illumos and similar systems since I've heard about quite a few dehydrated users on those platforms, but since the use of hexdump is relatively new maybe nobody else ran into that issue yet.

For now it should only be used for EAB handling so it's not critical for most users, but dehydrated checks for its existence in any case, so if it's not available dehydrated will refuse to work. Since that also should only be important for registration I could at least move the check into that function so it doesn't disrupt any other operation..

Unfortunately xxd doesn't seem to exist in busybox systems while hexdump does, so I'd still prefer hexdump here. A solution without external tools would be ideal but I don't think that's possible with bash.

If you can suggest a replacement that's available everywhere and ideally pre-installed on even minimal systems I'd reconsider changing it, but for now I think I'll stay with hexdump and will consider moving the check to right before it's actually been required. Leaving this ticket open for now as a reminder.

drboone commented 1 year ago

Moving that check would solve my problems, at least.

It seems like it ought to be possible to use awk to do this. I think even the busybox awk should be capable. And awk is already on the requirements list.

dbrooke commented 1 year ago

I recently upgraded a SmartOS (Illumos derived) system and hit this issue.

For Linux and SmartOS (the only platforms I have readily available) the following seems equivalent so I thought I'd mention it even though I appreciate that it may not meet your portability requirements to other platforms and I've not tested it within dehydrated.

od -t x1 -An | tr -d " \n"

bahamat commented 1 month ago

@lukas2511 So, I've been looking at this today, and I think od is probably a better solution all around. od is in coreutils, so it's going to be an exceedingly rare exception for a Linux system to not have it. On Debian/Ubuntu, hexdump is in the bsdmainutils or bsdextrautils package, not util-linux like it is on other distros. FreeBSD also does not have hexdump (the command is named hd instead).

Using od -t xC -An | tr -d '[:space:]' produces identical output to hexdump -v -e '/1 "%02x"'.

In addition to od being included in coreutils on Linux, od is also part of the base OS on FreeBSD, macOS, NetBSD, OpenBSD, and illumos, and has a consistent POSIX usage interface across each.

I also have prototyped testing all binary values from 00 to FF using both od and hexdump with the following script:

#!/bin/sh

a=( {0..3}{0..7}{0..7} )

printf 'hexdump control: '
for i in "${a[@]}" ; do
  printf "\\$i" | hexdump -v -e '/1 "%02x"'
done | sha1sum

printf 'od comparison:   '
for i in "${a[@]}" ; do
  printf "\\$i" | od -t xC -An | tr -d '[:space:]'
done | sha1sum

This script produces the following output:

$ ./compare.sh 
hexdump control: 330c1810efa17b806411ae71cfc79211e4b4aa01  -
od comparison:   330c1810efa17b806411ae71cfc79211e4b4aa01  -

So we have provably identical output to the existing implementation, and od is will be more widely and consistently available. Given this, I'll open a PR to switch from hexdump to od.

Let me know if you have any additional thoughts on this.