Re: checksums situation

[Philip Balister <philip@balister.org>]

[-- Attachment #1: Type: text/plain, Size: 1755 bytes --]

Alessandro GARDICH wrote:
> Koen Kooi wrote:
>> On 28-02-09 10:57, Alessandro GARDICH wrote:
>>
>>> Last but more important : why the hell this feature is in the default
>>> dev branch ???
>>
>> It was discussed over a period of weeks and RFC'ed, so bitching about 
>> it now is just trolling.
>>
>>
>> _______________________________________________
>> Openembedded-devel mailing list
>> Openembedded-devel@lists.openembedded.org
>> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-devel
> 
> 
> Ok my fault, I read mailing list to few ...
> 
> but a little question remain, why in the main .dev when is so few tested 
>  and broke a lot of build ...

I think there are two issues at the moment:

1) Build breakage caused by the addition of new sources without the 
corresponding checksums. This leads to build failures for people 
building with checksum checking enabled. For some reason, these failures 
have increased in recent weeks. People, please try to remember to add 
the checksums, even if you are building with checksums disabled.

2) The monolithic checksums.ini file does not currently provide an easy 
way for people to add checksums for packages that are in 
collections/private branches. I believe there is a proposal to fix this 
problem by allowing people to extend checksums.ini.

For "casual users", you can set:

OE_STRICT_CHECKSUMS = ""

this will not error on missing checksums, but will error if the checksum 
does not match. This detects bad downloads, upstream projects that 
change source without changing file names, and evil.

If people start paying a little more attention to 1 and we get 2 
implemented, much of the recent checksum noise will go away.

Philip

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3303 bytes --]