installing pharos on debian docker fails due to shasum verification failed error

[vasu-vi]

Source:

# using ubuntu:16.04, ubuntu:18.04, centos:latest all give same error
FROM debian

ENV CHPHAROS_TOKEN

WORKDIR /pharos

RUN apt-get update -y
RUN apt-get install -y curl
RUN curl -s https://get.pharos.sh | bash
RUN ln /usr/bin/sha1sum /usr/bin/shasum
RUN /bin/bash -c "source /usr/local/share/chpharos/chpharos.sh"
RUN source /usr/local/share/chpharos/chpharos.sh
# Fails
RUN chpharos install 1.3.3

Error:

...
Downloading 'pharos-cluster' (23899608 bytes) from https://get.pharos.sh/versions/download/pharos-cluster-linux-amd64-1.3.3 ..
######################################################################## 100.0%
Verifying download SHA256 checksum.. error: checksum verification failed
error: installation failed, use: chpharos list-remote to get a list of available versions.

sha files:

root@dd04f504a65d:/pharos# ls -lart /usr/bin/sha*
-rwxr-xr-x 2 root root 47976 Feb 22  2017 /usr/bin/shasum
-rwxr-xr-x 1 root root 60264 Feb 22  2017 /usr/bin/sha512sum
-rwxr-xr-x 1 root root 60264 Feb 22  2017 /usr/bin/sha384sum
-rwxr-xr-x 1 root root 56168 Feb 22  2017 /usr/bin/sha256sum
-rwxr-xr-x 1 root root 56168 Feb 22  2017 /usr/bin/sha224sum
-rwxr-xr-x 2 root root 47976 Feb 22  2017 /usr/bin/sha1sum

shasum: (does not have "-a" option)

root@dd04f504a65d:/pharos# shasum --version
sha1sum (GNU coreutils) 8.26
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by Ulrich Drepper, Scott Miller, and David Madore.
root@dd04f504a65d:/pharos# shasum --help
Usage: shasum [OPTION]... [FILE]...
Print or check SHA1 (160-bit) checksums.

With no FILE, or when FILE is -, read standard input.

  -b, --binary         read in binary mode
  -c, --check          read SHA1 sums from the FILEs and check them
      --tag            create a BSD-style checksum
  -t, --text           read in text mode (default)

The following five options are useful only when verifying checksums:
      --ignore-missing  don't fail or report status for missing files
      --quiet          don't print OK for each successfully verified file
      --status         don't output anything, status code shows success
      --strict         exit non-zero for improperly formatted checksum lines
  -w, --warn           warn about improperly formatted checksum lines

      --help     display this help and exit
      --version  output version information and exit

The sums are computed as described in FIPS-180-1.  When checking, the input
should be a former output of this program.  The default mode is to print a
line with checksum, a space, a character indicating input mode ('*' for binary,
' ' for text or where binary is insignificant), and name for each FILE.

GNU coreutils online help: <http://www.gnu.org/software/coreutils/>
Report sha1sum translation bugs to <http://translationproject.org/team/>
Full documentation at: <http://www.gnu.org/software/coreutils/sha1sum>
or available locally via: info '(coreutils) sha1sum invocation'

Solution 1

Update /usr/local/share/chpharos/chpharos.sh and replace 'shasum -a' with 'sha256sum'

Solution 2

Download directly a specific version via this command:

curl -X GET -o ./pharos $(curl -X GET https://get.pharos.sh/versions/download/pharos-cluster-linux-amd64-1.3.3 -k --header "Authorization: Bearer $TOKEN")

where TOKEN is located in ~/.chpharosrc (after you successfully login)

[kke]

The shasum tool seems to be a part of the perl package.

FROM debian

ENV CHPHAROS_TOKEN 
WORKDIR /pharos

RUN apt-get update -y
RUN apt-get install -y curl perl
RUN curl -s https://get.pharos.sh | bash
RUN chpharos-exec -i 1.3.3 pharos --version