xargs with multiple commands only working on some files - bash

Question

I'm trying (starting with my Macbook) to get a list of all image files matching the specification in the line below along with their size and sha512. I'm doing this to audit the tens of thousands of such files I have spread over mutliple systems.
sudo find /Users \( -iname '*.JPG' -or -iname '*.NEF' -or -iname '*.PNG'
-or -iname '*.RAF' -or -iname '*.PW2' -or -iname '*.DNG' \) -type f -and
-size +10000k -print0 | xargs -0 -I ##
/bin/bash -c '{ stat -n -f"MACBOOK %z " "##" && shasum -p -a 512 "##"; }'
When run, this correctly produces the output I want for some of the files, for example I get;
MACBOOK 32465640 <SHA512-REDACTED> ?/Users/<REDACTED>/Pictures/Pendleton Roundup/2018/2018-09-13/_DSC3955.NEF
But for some of the files, the ## replacement doesn't seem to work properly and instead I get;
MACBOOK 28130793 shasum: ##:
If I add a -v flag to the bash line to print out the commands I expect to be executed when it goes wrong I see this;
{ stat -n -f"MACBOOK %z " "/Users/<REDACTED>/Pictures/Photos Library D750.photoslibrary/Masters/2018/07/29/20180729-223141/DSC_3274.NEF"; shasum -p -a 512 "##"; }
If I manually run that line with the ## replaced with the filename, it works as expected, so it seems that the -I ## parameter to xargs is somehow not always working and I'm at a loss as to what the cause might me.
Can anyone help me evolve a fix for this? I've tried putting the ## in quotes, tried with different patterns and always the same issue.

Answer 1

Consider:
find_args=( -false )
for type in jpg nef png raf pw2 dng; do
find_args+=( -o -name "*.$type" )
done
sudo find /Users '(' "${find_args[#]}" ')' \
-type f \
-size +10000k \
-exec sh -c '
for arg; do
stat -n -f"MACBOOK %z " "$arg"
shasum -p -a 512 "$arg"
done' _ {} +
Using -exec ... {} + lets find invoke only one copy of sh per batch of files (as many as will fit on a command line on your local platform).
Even more importantly, not using {} inside the sh -c argument avoids command injection vulnerabilities, which with the original code would allow malicious filenames to run arbitrary commands (especially important when you're running under sudo, so those commands would be executed as root!).

Answer 2

The problem isn't that you were using xargs. It's that your find was run with sudo but any process receiving your piped or redirected output was not run with sudo, so your permissions during the find do not match your permissions during the subsequent xargs execution.
So, for example, instead of running:
sudo ls -al >> list.txt
you should instead run the entire pipeline of commands with sudo, as follows:
sudo sh -c 'ls -al >> list.txt'

Answer 3

UPDATE: NOT RECOMMENDED - see comment below.
I seem to have a variant that works now without xargs.
sudo find /Users \( -iname '*.JPG' -or -iname '*.NEF' -or -iname '*.PNG' -or -iname '*.RAF'
-or -iname '*.PW2' -or -iname '*.DNG' \) -type f -and -size +10000k
-exec sh -c '{ stat -n -f"MACBOOK %z " "{}"; shasum -p -a 512 "{}"; }' {} \;