From 7f3e9c5347aacac588d3cbbb2394e7ecc076d415 Mon Sep 17 00:00:00 2001
From: Dan Helfman <witten@torsion.org>
Date: Wed, 14 May 2025 14:09:19 -0700
Subject: [PATCH] Fix for the "spot" check's "xxh64sum_command" option erroring
 on commands containing spaces (#1095).

---
 NEWS                             | 2 ++
 borgmatic/actions/check.py       | 6 +++++-
 tests/unit/actions/test_check.py | 6 ++++--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/NEWS b/NEWS
index 2f29ba55..f6d2305b 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@
  * #1093: Fix for the LVM hook erroring when the "--dry-run" flag is used.
  * #1094: Fix incorrect documentation about customizing Borg exit codes:
    https://torsion.org/borgmatic/docs/how-to/customize-warnings-and-errors/
+ * #1095: Fix for the "spot" check's "xxh64sum_command" option erroring on commands containing
+   spaces.
  * Add support for Borg 2's "s3:" and "b2:" repository URLs, so you can backup to S3 or B2 cloud
    storage services even without using Rclone.
 
diff --git a/borgmatic/actions/check.py b/borgmatic/actions/check.py
index 34800553..23bbb48d 100644
--- a/borgmatic/actions/check.py
+++ b/borgmatic/actions/check.py
@@ -6,6 +6,7 @@ import logging
 import os
 import pathlib
 import random
+import shlex
 import shutil
 
 import borgmatic.actions.pattern
@@ -512,7 +513,10 @@ def compare_spot_check_hashes(
             break
 
         hash_output = borgmatic.execute.execute_command_and_capture_output(
-            (spot_check_config.get('xxh64sum_command', 'xxh64sum'),)
+            tuple(
+                shlex.quote(part)
+                for part in shlex.split(spot_check_config.get('xxh64sum_command', 'xxh64sum'))
+            )
             + tuple(
                 path for path in source_sample_paths_subset if path in hashable_source_sample_path
             ),
diff --git a/tests/unit/actions/test_check.py b/tests/unit/actions/test_check.py
index c0c4af43..6c49b782 100644
--- a/tests/unit/actions/test_check.py
+++ b/tests/unit/actions/test_check.py
@@ -1071,7 +1071,9 @@ def test_compare_spot_check_hashes_uses_xxh64sum_command_option():
     flexmock(module.os.path).should_receive('islink').and_return(False)
     flexmock(module.borgmatic.execute).should_receive(
         'execute_command_and_capture_output'
-    ).with_args(('/usr/local/bin/xxh64sum', '/foo', '/bar'), working_directory=None).and_return(
+    ).with_args(
+        ('/usr/local/bin/xxhsum', '-H64', '/foo', '/bar'), working_directory=None
+    ).and_return(
         'hash1  /foo\nhash2  /bar'
     )
     flexmock(module.borgmatic.borg.list).should_receive('capture_archive_listing').and_return(
@@ -1086,7 +1088,7 @@ def test_compare_spot_check_hashes_uses_xxh64sum_command_option():
                 {
                     'name': 'spot',
                     'data_sample_percentage': 50,
-                    'xxh64sum_command': '/usr/local/bin/xxh64sum',
+                    'xxh64sum_command': '/usr/local/bin/xxhsum -H64',
                 },
             ]
         },