PXE-BOOT: MD5 to SHA256 : "Failed to provide image MD5 data"

[Christoph Herrmann]

Hello!

So far, we've successfully built and booted PXE-bootable images with Kiwi on OpenSUSE 15.6.

Now we're trying to do the same on OpenSUSE 16. The build works. However, a SHA256 checksum file is now being created (previously MD5). The checks in the generated initrd still seem to be expecting MD5. Therefore, we're getting the error message "Failed to provide image MD5 data".

How can we resolve this elegantly? It seems to me that we either need to be able to generate MD5 checksums again, or that we need to get SHA256 checks into the initrd.

How can we fix this?

Thanks and best regards,

Christoph

[Marcus Schäfer]

Hi Christoph,

happy new year 2026 ... and sorry for the delay

> Hello!
> So far, we've successfully built and booted PXE-bootable images with
> Kiwi on OpenSUSE 15.6.
> Now we're trying to do the same on OpenSUSE 16. The build works.
> However, a SHA256 checksum file is now being created (previously MD5).
> The checks in the generated initrd still seem to be expecting MD5.
> Therefore, we're getting the error message "Failed to provide image MD5
> data".

So yes this problem appears if you are building with a newer version
of kiwi but your image build still installs kiwi components
(dracut-kiwi-xxx packages in your case) from older kiwi versions.
When we did the move from md5 to sha256 changes in the kiwi builder
code as well as changes in the kiwi dracut modules were required.
We did all these changes but as a user you can still install
packages from any repo setup you prefer which in this case can
lead to the issue you ran into.

> How can we resolve this elegantly?

I assume you want to perform the move from md5 checking to sha256 ?
Actually it would be good if you aim for it since md5 is deprecated.
As such your image build needs to add a repository which also provides
the updated dracut-kiwi-xxx packages. The most simple way to do is
adding the kiwi release repository to your image description:

<repository type="rpm-md" alias="kiwi" priority="1">
<source path="obs://Virtualization:Appliances:Builder/openSUSE_Leap_16.0"/>
</repository>

This makes sure your image build pulls in the kiwi dracut module
packages from our current stable release. If you in combination to this
also use the kiwi builder from the above repo to build your image you
will always be compatible with all image building components we provide.

The same applies if you strictly use the packages provided from the
release repos of the distribution. Only in case of a mix (e.g using a new
builder but with older repos) you can be in trouble.

> It seems to me that we either need
> to be able to generate MD5 checksums again, or that we need to get
> SHA256 checks into the initrd.

I do not recommend to rebuild md5 checksums

Hope this helps

Regards,
Marcus
--
Public Key available via: https://keybase.io/marcus_schaefer/key.asc
keybase search marcus_schaefer