[Buildroot] [PATCH 1/3 v2] support/download: teach dl-wrapper to handle more than one hash file
Peter Korsgaard
peter at korsgaard.com
Tue Nov 7 10:46:16 UTC 2023
>>>>> "Yann" == Yann E MORIN <yann.morin.1998 at free.fr> writes:
> Currently, we expect and only use hash files that lie within the package
> directory, alongside the .mk file. Those hash files are thus bundeld
> with Buildroot.
> This implies that only what's known to Buildroot can ever get into those
> hash files. For packages where the version is fixed (or a static
> choice), then we can carry hashes for those known versions.
> However, we do have a few packages for which the version is a free-form
> entry, where the user can provide a custom location and/or version. like
> a custom VCS tree and revision, or a custom tarball URL. This means that
> Buildroot has no way to be able to cary hashes for such custom versions.
> This means that there is no integrity check that what was downloaded is
> what was expected. For a sha1 in a git tree, this is a minor issue,
> because the sha1 by itself is already a hash of the expected content.
> But for custom tarballs URLs, or for a tag in a VCS, there is indeed no
> integrity check.
> Buildroot can't provide such hashes, but interested users may want to
> provide those, and currently there is no (easy) way to do so.
> So, we need our download helpers to be able to accept more than one hash
> file to lookup for hashes.
> Extend the dl-wrapper and the check-hash helpers thusly, and update the
> legal-info accordingly.
> Note that, to be able to pass more than one hash file, we also need to
> re-order the arguments passed to support/download/check-hash, which also
> impies some shuffling in the three places it is called:
> - 2 in dl-wrapper
> - 1 in the legal-info infra
> That in turn also requires that the legal-license-file macro args get
> re-ordered to have the hash file last; we take the opportunity to also
> move the HOST/TARGET arg to be first, like in the other legal-info
> macros.
> Reported-by: "Martin Zeiser (mzeiser)" <mzeiser at cisco.com>
> Signed-off-by: Yann E. MORIN <yann.morin.1998 at free.fr>
> Cc: Peter Korsgaard <peter at korsgaard.com>
> ---
> Changes v1 -> v2:
> - restore legal-info (Peter K.)
Committed, thanks.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list