From mboxrd@z Thu Jan 1 00:00:00 1970 From: Yann E. MORIN Date: Fri, 17 Jan 2014 23:41:36 +0100 Subject: [Buildroot] [PATCH 5/6] pkg-infra: add possiblity to check downloaded files against known hashes In-Reply-To: <52D64559.90705@mind.be> References: <52D5AE11.60804@mind.be> <20140114233438.GL3328@free.fr> <52D64559.90705@mind.be> Message-ID: <20140117224136.GE3982@free.fr> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: buildroot@busybox.net Arnout, All, On 2014-01-15 09:22 +0100, Arnout Vandecappelle spake thusly: > On 15/01/14 00:34, Yann E. MORIN wrote: > >Arnout, All, > > > >On 2014-01-14 22:37 +0100, Arnout Vandecappelle spake thusly: > >>On 13/01/14 00:44, Yann E. MORIN wrote: > [snip] > >>>Note-2: The laternative to sha1 would be sha2 (256- or 512-bit), but > >>>oldish "enterprise-class" distributions may be missing them entirely. > >>>sha256sum and sha512sum were added to coreutils in 2005-10-23, and RHEL5 > >>>seems to have them. But better be safe than sorry. If sha2 should be > >>>considered instead of sha1, then it is very easy to switch now. Switching > >>>later would require that we revalidate all packages that have hashes, > >>>which could prove to be quite time-demanding if we have lots of > >>>packages using hashes. > >> > >> We can be more future-safe by storing the hash that is used in the .hash > >>file itself. > > > >Hu? > > If the hash file contains the following: > > 486fb55c3efa71148fe07895fd713ea3a5ae343a sha1 libfoo-1.2.3.tar.bz2 OK, I see what you meant, now. > then you can now let the script check that the second field is sha1, and > later you can support different hash methods. In that case, it is not > necessary to update all the files when we want to switch to a new hash > method. However, that means the file is no longer the output of: sha1sum files-to-check* >package.hash or of any other hash utility: sha*sum all generates similarly-formatted outputs: hash filename Which was the reason I choose that format. If we'd use your suggestion, we'd need a simple way to generate that file, or it'd be error prone. Regards, Yann E. MORIN. -- .-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'