[Buildroot] [PATCH 1/1] support/download: enforce BR2_DOWNLOAD_FORCE_CHECK_HASHES=y for missing hash files

[Buildroot] [PATCH 1/1] support/download: enforce BR2_DOWNLOAD_FORCE_CHECK_HASHES=y for missing hash files

[Fiona Klute via buildroot]

BR2_DOWNLOAD_FORCE_CHECK_HASHES=y is supposed to make the build fail
if any download cannot be successfully verified against a known
hash. However, support/download/check-hash would only warn if there
was no hash file at all for the package in question, and allow the
build to continue.

This is a security fix and should be backported to all stable
branches.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
---
 package/pkg-download.mk     | 1 +
 support/download/check-hash | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/package/pkg-download.mk b/package/pkg-download.mk
index b38f0c7053..896fb59def 100644
--- a/package/pkg-download.mk
+++ b/package/pkg-download.mk
@@ -116,6 +116,7 @@ define DOWNLOAD
 	SFTP="$(call qstrip,$(BR2_SFTP))" \
 	SVN="$(call qstrip,$(BR2_SVN))" \
 	WGET="$(call qstrip,$(BR2_WGET))" \
+	BR2_DOWNLOAD_FORCE_CHECK_HASHES="$(BR2_DOWNLOAD_FORCE_CHECK_HASHES)" \
 	BR_NO_CHECK_HASH_FOR="$(if $(BR2_DOWNLOAD_FORCE_CHECK_HASHES),,$(BR_NO_CHECK_HASH_FOR))" \
 		flock $($(PKG)_DL_DIR)/.lock $(DL_WRAPPER) \
 		-c '$($(PKG)_DL_VERSION)' \
diff --git a/support/download/check-hash b/support/download/check-hash
index d18ec8b134..669c3a0d78 100755
--- a/support/download/check-hash
+++ b/support/download/check-hash
@@ -98,7 +98,7 @@ for h_file in "${h_files[@]}"; do
 done
 
 # shellcheck disable=SC2086  # nb_h_files is a non-empty int
-if [ ${nb_h_files} -eq 0 ]; then
+if [ ${nb_h_files} -eq 0 ] && [ "$BR2_DOWNLOAD_FORCE_CHECK_HASHES" != y ]; then
     printf "WARNING: no hash file for %s\n" "${base}" >&2
     exit 0
 fi
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] support/download: enforce BR2_DOWNLOAD_FORCE_CHECK_HASHES=y for missing hash files

[Peter Korsgaard]

>>>>> "Fiona" == Fiona Klute via buildroot <buildroot@buildroot.org> writes:

 > BR2_DOWNLOAD_FORCE_CHECK_HASHES=y is supposed to make the build fail
 > if any download cannot be successfully verified against a known
 > hash. However, support/download/check-hash would only warn if there
 > was no hash file at all for the package in question, and allow the
 > build to continue.

 > This is a security fix and should be backported to all stable
 > branches.

 > Signed-off-by: Fiona Klute <fiona.klute@gmx.de>

Committed, thanks.

Maybe we need some more download tests?

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] support/download: enforce BR2_DOWNLOAD_FORCE_CHECK_HASHES=y for missing hash files

[Raphaël Mélotte via buildroot]

In reply of:
> BR2_DOWNLOAD_FORCE_CHECK_HASHES=y is supposed to make the build fail
> if any download cannot be successfully verified against a known
> hash. However, support/download/check-hash would only warn if there
> was no hash file at all for the package in question, and allow the
> build to continue.
> 
> This is a security fix and should be backported to all stable
> branches.
> 
> Signed-off-by: Fiona Klute <fiona.klute@gmx.de>

Applied to 2025.02.x, 2026.08.x. Thanks

> ---
>  package/pkg-download.mk     | 1 +
>  support/download/check-hash | 2 +-
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/package/pkg-download.mk b/package/pkg-download.mk
> index b38f0c7053..896fb59def 100644
> --- a/package/pkg-download.mk
> +++ b/package/pkg-download.mk
> @@ -116,6 +116,7 @@ define DOWNLOAD
>  	SFTP="$(call qstrip,$(BR2_SFTP))" \
>  	SVN="$(call qstrip,$(BR2_SVN))" \
>  	WGET="$(call qstrip,$(BR2_WGET))" \
> +	BR2_DOWNLOAD_FORCE_CHECK_HASHES="$(BR2_DOWNLOAD_FORCE_CHECK_HASHES)" \
>  	BR_NO_CHECK_HASH_FOR="$(if $(BR2_DOWNLOAD_FORCE_CHECK_HASHES),,$(BR_NO_CHECK_HASH_FOR))" \
>  		flock $($(PKG)_DL_DIR)/.lock $(DL_WRAPPER) \
>  		-c '$($(PKG)_DL_VERSION)' \
> diff --git a/support/download/check-hash b/support/download/check-hash
> index d18ec8b134..669c3a0d78 100755
> --- a/support/download/check-hash
> +++ b/support/download/check-hash
> @@ -98,7 +98,7 @@ for h_file in "${h_files[@]}"; do
>  done
>  
>  # shellcheck disable=SC2086  # nb_h_files is a non-empty int
> -if [ ${nb_h_files} -eq 0 ]; then
> +if [ ${nb_h_files} -eq 0 ] && [ "$BR2_DOWNLOAD_FORCE_CHECK_HASHES" != y ]; then
>      printf "WARNING: no hash file for %s\n" "${base}" >&2
>      exit 0
>  fi
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot