[Buildroot] [PATCH] ser2net: Add a hash file

[Gustavo Zacarias <gustavo@zacarias.com.ar>]

On 10/08/2014 08:25 AM, Markos Chandras wrote:

> Sure. But this probably is not a strong argument because for all I know
> they may find sha256 broken tomorrow morning and you have to update all
> the buildroot packages using that hash to verify the tarball. If you
> think something is "not strong enough" then don't use it :)
> Perhaps it's best if buildroot supported the two strongest algorithms
> and request that information for every package? I really see no point
> supporting eg md5 since we know it's weak. Anyway, that's my personal
> opinion, I just feel there is no clear "rule" here so developers are
> free to use whatever they want which may not always be acceptable by the
> maintainers :)

Those last lines ^^^ :)
If upstream maintainers ship with md5 there's not much we can do about it.
In the end we do hashes for integrity above everything else and we don't
want to get in the way of new/bumped packages hence hashes aren't
mandatory for now (it would be good to have them all though).
Regards.

PS: and to detect sucky upstream that switches tarballs without bumping
versions to cover their lower heads.