Debian's packages docker-desktop-amd64 contains unspecified checksums instead of md5sum

[isdchris]

Description

The docker-desktop-amd64.deb package contains a DEBIAN/md5sums / (gets installed as /var/lib/dpkg/info/docker-desktop.md5sums) that uses was seems to be different checksum method (sha256?), instead of md5sums for checksums

i.e.: This is for 4.35.1-173168 version for Debian (tested with Bookworm and Trixie)

0e082cb6fc76568a445d7c3a65df132afc38bcf74600ac09cc8ae3eece021768 DEBIAN/control
30838e4882eed06f2f04336ab01d94dcec401f2ea7948a0e9663af00e6c3910a DEBIAN/postinst
66b7689f1c6d427275b37e9b10e3aa3f286bf34598491840aef8630900214279 DEBIAN/postrm
f2cea5ccabb8d8445baa7cc4cad5770e40e448f1be340698369dadc3bc7f9500 DEBIAN/prerm
413a3420609da18c4aeb58d080160e42cc0266ee5a3a3a84fac74e6a634e2fe7 opt/docker-desktop/Docker Desktop
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d opt/docker-desktop/LICENSE.electron.txt
8551a209c3ccc323da2f80d6df170f4688bf41415be5e0ab8b9e7f99c2dec95d opt/docker-desktop/LICENSES.chromium.html
27d263d3604f37054026fefee5fac1109460249de65e42e012dbf998d21df68e opt/docker-desktop/bin/com.docker.admin
cf78afbbe9452b94d267ad13d25bf3417e90e5a4d66b65e5396eb852633ce079 opt/docker-desktop/bin/com.docker.backend

Tools like dpkg and debsums however require the checksum in this file to be a md5sum.
Please supply md5sums in /var/lib/dpkg/info/docker-desktop.md5sums to fix this issue.

Reproduce

Running dpkg --verify docker-desktop leads to:
dpkg: error: control file 'md5sums' for package 'docker-desktop' is missing value separator

debsums will also complain with several

debsums: invalid line (1) in md5sums for docker-desktop: 0e082cb6fc76568a445d7c3a65df132afc38bcf74600ac09cc8ae3eece021768 DEBIAN/control
debsums: invalid line (2) in md5sums for docker-desktop: 30838e4882eed06f2f04336ab01d94dcec401f2ea7948a0e9663af00e6c3910a DEBIAN/postinst
debsums: invalid line (3) in md5sums for docker-desktop: 66b7689f1c6d427275b37e9b10e3aa3f286bf34598491840aef8630900214279 DEBIAN/postrm
debsums: invalid line (4) in md5sums for docker-desktop: f2cea5ccabb8d8445baa7cc4cad5770e40e448f1be340698369dadc3bc7f9500 DEBIAN/prerm
debsums: invalid line (5) in md5sums for docker-desktop: 413a3420609da18c4aeb58d080160e42cc0266ee5a3a3a84fac74e6a634e2fe7 opt/docker-desktop/Docker Desktop handler.desktop
[... many more lines....]
debsums: invalid line (140) in md5sums for docker-desktop: 554c878132fd1599ca8ed617fd090e8e4d2c9aea1e3dd5e0efd9f8778585aec8 usr/share/applications/docker-desktop.desktop

Expected behavior

Both dpkg --verify docker-desktop and debsums should work fine.

docker version

Client: Docker Engine - Community
 Version:           27.3.1
 API version:       1.41 (downgraded from 1.47)
 Go version:        go1.22.7
 Git commit:        ce12230
 Built:             Fri Sep 20 11:41:11 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: linux/amd64/debian-unknown
 Podman Engine:
  Version:          5.3.1
  APIVersion:       5.3.1
  Arch:             amd64
  BuildTime:        2024-11-25T17:26:43+01:00
  Experimental:     false
  GitCommit:        
  GoVersion:        go1.23.3
  KernelVersion:    6.11.10-amd64
  MinAPIVersion:    4.0.0
  Os:               linux
 Conmon:
  Version:          conmon version 2.1.12, commit: unknown
  Package:          conmon_2.1.12-3_amd64
 OCI Runtime (runc):
  Version:          runc version 1.1.14
commit: v1.1.14-0-g2c9f560
spec: 1.0.2-dev
go: go1.22.9
libseccomp: 2.5.5
  Package:          containerd.io_1.7.23-1_amd64
 Engine:
  Version:          5.3.1
  API version:      1.41 (minimum version 1.24)
  Go version:       go1.23.3
  Git commit:       
  Built:            Mon Nov 25 17:26:43 2024
  OS/Arch:          linux/amd64
  Experimental:     false

docker info

Client: Docker Engine - Community
 Version:    27.3.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.17.1-desktop.1
    Path:     /usr/lib/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.29.7-desktop.1
    Path:     /usr/lib/docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container (Docker Inc.)
    Version:  0.0.37
    Path:     /usr/lib/docker/cli-plugins/docker-debug
  desktop: Docker Desktop commands (Alpha) (Docker Inc.)
    Version:  v0.0.15
    Path:     /usr/lib/docker/cli-plugins/docker-desktop
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.2
    Path:     /usr/lib/docker/cli-plugins/docker-dev
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.27
    Path:     /usr/lib/docker/cli-plugins/docker-extension
  feedback: Provide feedback, right in your terminal! (Docker Inc.)
    Version:  v1.0.5
    Path:     /usr/lib/docker/cli-plugins/docker-feedback
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.3.0
    Path:     /usr/lib/docker/cli-plugins/docker-init
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /usr/lib/docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.14.0
    Path:     /usr/lib/docker/cli-plugins/docker-scout

Server:
 Containers: 2
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 3
 Server Version: 5.3.1
 Storage Driver: overlay
  Supports volatile: true
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  Using metacopy: false
  Supports shifting: true
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge macvlan ipvlan
  Log: k8s-file none passthrough journald
 Swarm: inactive
 Runtimes: youki crun crun-wasm kata runc runsc crun-vm krun ocijail runj
 Default Runtime: runc
 Init Binary: 
 containerd version: 
 runc version: 
 init version: 
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 6.11.10-amd64
 Operating System: debian
 OSType: linux
 Architecture: amd64
 CPUs: 4
 Total Memory: 15.5GiB
 Name: isd-schlumpf2
 ID: 49d80796-8498-478a-a758-92b2e93ff3c7
 Docker Root Dir: /var/lib/containers/storage
 Debug Mode: false
 Experimental: true
 Live Restore Enabled: false
 Product License: Apache-2.0

Diagnostics ID

728FC644-F7AC-4B1A-9336-B2EF5B94E79B/20241202152056

Additional Info

No response

[thaJeztah]

Thanks for reporting; I'm not working on docker desktop for linux myself, but had a quick peek at the packaging code; it looks like there was a refactor at some point to share code that calculates hashes, and I suspect that shared code was at some point changed from md5 to sha256, therefore changing this file with it.

[asvishnyakov]

I wanted to check my packages checksums after an unexpected system crash and find out the same with latest release. Please fix

[thaJeztah]

@asvishnyakov can you try downloading using the links from the release-notes page? I think the link from the setup guide (https://docs.docker.com/desktop/setup/install/linux/ubuntu/) still points to the previous version; I know some of the links are controlled through a different process and not immediately updated to latest.

https://docs.docker.com/desktop/release-notes/#4371

I downloaded the 4.37.1 .deb package from that link (https://desktop.docker.com/linux/main/amd64/178034/docker-desktop-amd64.deb), and it looks like the md5sums in that package has correct (md5) checksums;

4966da9f995d5350d701cd87c917948c  DEBIAN/control
1dd42c6aa00123e59afeaae10a96711e  DEBIAN/postinst
35f1741bd2774b66b48c81e724f8327d  DEBIAN/postrm
a51d9a5b418ada9b002efa96fbeb859a  DEBIAN/prerm
d14629aa35fa3fb1eb4c8d3c73b3200c  opt/docker-desktop/Docker Desktop
4d42118d35941e0f664dddbd83f633c5  opt/docker-desktop/LICENSE.electron.txt
7af15e71545288699e5011e4c4059124  opt/docker-desktop/LICENSES.chromium.html
....

[thaJeztah]

FWIW, the release-notes page also has a link to checksums for the packages as a whole (e.g., https://desktop.docker.com/linux/main/amd64/178610/checksums.txt for the above build)

[asvishnyakov]

@thaJeztah Yeah, I already created an issue about that: #265
md5sums in latest deb looks fine, while for some reason debsums still create a warning about DEBIAN/* files. Maybe they removed or modified on post-installation.