Skip to content

fix: shasum -c / sha256sum -c read checksum lines from stdin - #88

Merged
davydog187 merged 1 commit into
mainfrom
cursor/shasum-c-stdin-operand-363d
Aug 21, 2026
Merged

fix: shasum -c / sha256sum -c read checksum lines from stdin#88
davydog187 merged 1 commit into
mainfrom
cursor/shasum-c-stdin-operand-363d

Conversation

@davydog187

@davydog187 davydog187 commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

Fixes #81

shasum -c / sha256sum -c treated - as a filesystem path and treated a missing operand as success after verifying nothing. That is a silent wrong answer for agent tool-use: a caller checking a checksum got exit 0 whether or not the file matched.

GNU coreutils sha256sum and Perl shasum both read checksum lines from stdin when the operand is - or when there is no operand. The hashing path already had that StdinOperand treatment (PR #74); check mode did not.

User-visible behavior

# before
$ printf 'HASH  /f\n' | sha256sum -c -
# => rc=1, sha256sum: -: No such file or directory

$ printf 'HASH  /f\n' | sha256sum -c
# => rc=0, no output

# after (matches GNU/BSD)
$ printf 'HASH  /f\n' | sha256sum -c -
# => rc=0, /f: OK

$ printf 'HASH  /f\n' | sha256sum -c
# => rc=0, /f: OK

A checksum file operand is unchanged: sha256sum -c /sums still verifies that file. A mismatch still prints FAILED and exits 1. JustBash.exec/2 does not raise.

Changes

  • Check mode uses defaults_to_stdin/1, so a missing operand is -
  • Check mode reads the checksum list through StdinOperand.read/4, so - is stdin rather than a path
  • Tests cover - as stdin, a missing operand, a normal file operand, and a mismatch via stdin — for both sha256sum and shasum

Type of Change

  • Bug fix (non-breaking change which fixes an issue)

Testing

  • Added new tests
  • All existing tests pass
  • Checked against GNU sha256sum 9.4 and Perl shasum 6.04

Local gates:

mix compile --warnings-as-errors
mix format --check-formatted
mix credo --strict   # only the pre-existing apply/2 test fixture
mix test
# Finished in 32.5 seconds
# 2 doctests, 62 properties, 5364 tests, 0 failures (5 excluded)
mix docs --warnings-as-errors
mix dialyzer
# Total errors: 13, Skipped: 13, Unnecessary Skips: 0

Checklist

  • My code follows the style guidelines of this project
  • I have run mix format
  • I have run mix credo and addressed any issues
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing tests pass locally with my changes
Open in Web Open in Cursor 

Check mode treated `-` as a filesystem path and treated a missing
operand as success after verifying nothing. GNU/BSD coreutils read
checksum lines from stdin in both cases. Apply the same StdinOperand
treatment the hashing path already had.

Co-authored-by: Dave Lucia <davelucianyc@gmail.com>
@davydog187
davydog187 marked this pull request as ready for review August 21, 2026 16:33
@davydog187
davydog187 merged commit cdddddc into main Aug 21, 2026
4 checks passed
@davydog187
davydog187 deleted the cursor/shasum-c-stdin-operand-363d branch August 21, 2026 16:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

shasum -c / sha256sum -c resolve - as a path, and with no operand exit 0 having verified nothing

2 participants