[Buildroot] [PATCH 2/4] pciutils: add hash file

[Gustavo Zacarias <gustavo@zacarias.com.ar>]

On 10/15/2014 07:33 PM, Peter Korsgaard wrote:

> While this checksum matches the .asc file, it is different than what
> was on the old server (and on sources.buildroot.org, autobuilders and
> whatnot) - And as pciutils hasn't been bumped since Nov 2013 people are
> quite likely to already have it in their dl/.
> 
> As pciutils isn't really such a security sensitive package, I think we
> should wait with this until the version is bumped next time.

That shouldn't be a decisive factor, you're looking for consistency
besides security and it shouldn't reduce the effort in doing so.
I can argue that the security factor is indeed important, if you run
things as root (lspci, setpci) - which is common in embedded targets -
and the tarball installs a nifty backdoor then you probably wouldn't be
too happy about it.
I know it would be odd to use those tools outside development.
So compromise solution: switch to a new tarball format, that one isn't
cached anywhere.
Regards.