Binary package hint: euca2ools
The check_image function at [1,2] has incorrect indentation.
sha_image = sha()
while 1:
buf=in_file.read(IMAGE_IO_CHUNK)
if not buf:
break
sha_image.update(buf)
return image_size, hexlify(sha_image.digest())
The result is that the above always returns the same sha1sum as 'sha1sum /dev/null', and thus all euca2ools generated manifests have the string:
<digest algorithm="SHA1">da39a3ee5e6b4b0d3255bfef95601890afd80709</digest>
I'm not sure what the checksum is used for here, so I'm not sure if this is a security issue (I dont think so).
--
[1] http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/maverick/euca2ools/maverick/annotate/head:/euca2ools/euca2ools/__init__.py?start_revid=23#L513
[2] http://bazaar.launchpad.net/~eucalyptus-maintainers/euca2ools/euca2ools-main/annotate/head:/euca2ools/euca2ools/__init__.py#L625
This issue has been fixed in upstream as revision 318.