Odd python dynamic library alert

[nycaleksey]

I have upgraded to 21.1.3 this morning and tried the new health-check feature. One line in the output caught my attention:

python37-3.7.10: checksum mismatch for /usr/local/lib/python3.7/lib-dynload/_sha1.so

I SSH'd into the box and run "ls -l" for this file:

-rwxr-xr-x  1 root  wheel  23200 Mar  8 18:56 /usr/local/lib/python3.7/lib-dynload/_sha1.so

SHA256 of it is 5766a1b659b7e022cbdeeaf6a7a43f6e537ddefbd3dd420ade6a37edf86abc71

I ran the file through VT and it came back clean - https://www.virustotal.com/gui/file/5766a1b659b7e022cbdeeaf6a7a43f6e537ddefbd3dd420ade6a37edf86abc71/detection

After reinstalling python37 package, the issue went away. The size and timestamp of the file did not change, but the checksum is now 972e976dfd77b703ed0104723f12db94d5f0fdcb92761e0ca5e380d65cc6b10e

Running both files through strings command results in the exact same output. Binary diffing the suspicious and valid files shows some odd bytes being different here and there, but the diffs do not look too suspicious to my untrained eye.

Did anyone see the same issue by any chance? Do you think I should be concerned?

Thank you

[franco]

Probably a file system error. The health check can assist with this to avoid "strange" bugs later on if the mangled bytes would actually cause malfunction.

It happens more on packages like python because it has a large number of files in the system...


Cheers,
Franco

[JoK]

I got the same issue, I did as you wrote to solve the problem, and it worked