[Buildroot] [PATCH 1/4] netstat-nat: add hash file

[Buildroot] [PATCH 1/4] netstat-nat: add hash file

[Gustavo Zacarias]

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
---
 package/netstat-nat/netstat-nat.hash | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 package/netstat-nat/netstat-nat.hash

diff --git a/package/netstat-nat/netstat-nat.hash b/package/netstat-nat/netstat-nat.hash
new file mode 100644
index 0000000..924da12
--- /dev/null
+++ b/package/netstat-nat/netstat-nat.hash
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256	e945faa283a49f33af15de915a949c9273a230fc17154925364c547adab676ca	netstat-nat-1.4.10.tar.gz
-- 
2.3.6

[Buildroot] [PATCH 2/4] rp-pppoe: add hash file

[Gustavo Zacarias]

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
---
 package/rp-pppoe/rp-pppoe.hash | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 package/rp-pppoe/rp-pppoe.hash

diff --git a/package/rp-pppoe/rp-pppoe.hash b/package/rp-pppoe/rp-pppoe.hash
new file mode 100644
index 0000000..ab162ee
--- /dev/null
+++ b/package/rp-pppoe/rp-pppoe.hash
@@ -0,0 +1,2 @@
+# Locally calculated after checking pgp signature
+sha256	86a1a4d92fcea74fa6dd45516c5975933fa978b36fafe71f76ea70b4b4747720	rp-pppoe-3.11.tar.gz
-- 
2.3.6

[Buildroot] [PATCH 3/4] transmission: add hash file

[Gustavo Zacarias]

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
---
 package/transmission/transmission.hash | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 package/transmission/transmission.hash

diff --git a/package/transmission/transmission.hash b/package/transmission/transmission.hash
new file mode 100644
index 0000000..4199b37
--- /dev/null
+++ b/package/transmission/transmission.hash
@@ -0,0 +1,2 @@
+# Locally calculated
+sha256	a9fc1936b4ee414acc732ada04e84339d6755cd0d097bcbd11ba2cfc540db9eb	transmission-2.84.tar.xz
-- 
2.3.6

[Buildroot] [PATCH 4/4] popt: add hash file

[Gustavo Zacarias]

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
---
 package/popt/popt.hash | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 package/popt/popt.hash

diff --git a/package/popt/popt.hash b/package/popt/popt.hash
new file mode 100644
index 0000000..4d93e47
--- /dev/null
+++ b/package/popt/popt.hash
@@ -0,0 +1,2 @@
+# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum
+sha256	e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8	popt-1.16.tar.gz
-- 
2.3.6

[Buildroot] [PATCH 4/4] popt: add hash file

[Baruch Siach]

Hi Gustavo,

On Tue, Jul 07, 2015 at 09:52:32AM -0300, Gustavo Zacarias wrote:
> Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
> ---
>  package/popt/popt.hash | 2 ++
>  1 file changed, 2 insertions(+)
>  create mode 100644 package/popt/popt.hash
> 
> diff --git a/package/popt/popt.hash b/package/popt/popt.hash
> new file mode 100644
> index 0000000..4d93e47
> --- /dev/null
> +++ b/package/popt/popt.hash
> @@ -0,0 +1,2 @@
> +# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum

What does that mean?

> +sha256	e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8	popt-1.16.tar.gz

baruch

-- 
     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -

[Buildroot] [PATCH 4/4] popt: add hash file

[Gustavo Zacarias]

On 07/07/15 11:17, Baruch Siach wrote:

>> +# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum
>
> What does that mean?
>
>> +sha256	e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8	popt-1.16.tar.gz

Hi Baruch.
That i've verified that the md5 is right and then calculated the sha256.
Regards.

[Buildroot] [PATCH 4/4] popt: add hash file

[Baruch Siach]

On Tue, Jul 07, 2015 at 11:19:32AM -0300, Gustavo Zacarias wrote:
> On 07/07/15 11:17, Baruch Siach wrote:
> 
> >>+# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum
> >
> >What does that mean?
> >
> >>+sha256	e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8	popt-1.16.tar.gz
> 
> That i've verified that the md5 is right and then calculated the sha256.

Is there a reason not to have both md5 (from LFS) and sha256 (locally 
calculated)?

baruch

-- 
     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -

[Buildroot] [PATCH 4/4] popt: add hash file

[Gustavo Zacarias]

On 07/07/15 11:27, Baruch Siach wrote:

> Is there a reason not to have both md5 (from LFS) and sha256 (locally
> calculated)?

Yes, very subjective though.
Right now we're fetching from a mirror and that's where the md5 comes from.
Proper upstream is back but never provided a md5 or sig for the latest 
releases, so that md5 isn't "original".
I based my calculation on a locally cached popt tarball that predates 
the source change BTW.
And to be honest hashes that aren't backed by announcements (archived on 
mailing lists that are on separate infra, hence harder to tamper with) 
are worth almost nothing.
Regards.

[Buildroot] [PATCH 4/4] popt: add hash file

[Thomas Petazzoni]

Dear Gustavo Zacarias,

On Tue, 07 Jul 2015 11:34:35 -0300, Gustavo Zacarias wrote:

> Yes, very subjective though.
> Right now we're fetching from a mirror and that's where the md5 comes from.
> Proper upstream is back but never provided a md5 or sig for the latest 
> releases, so that md5 isn't "original".
> I based my calculation on a locally cached popt tarball that predates 
> the source change BTW.
> And to be honest hashes that aren't backed by announcements (archived on 
> mailing lists that are on separate infra, hence harder to tamper with) 
> are worth almost nothing.

Though our policy so far is to have the upstream hash when available,
and if it's too weak complement it with a locally calculated stronger
hash.

Thanks,

Thomas
-- 
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

[Buildroot] [PATCH 4/4] popt: add hash file

[Gustavo Zacarias]

On 07/07/15 11:53, Thomas Petazzoni wrote:

> Though our policy so far is to have the upstream hash when available,
> and if it's too weak complement it with a locally calculated stronger
> hash.

Yes, but this is a mirror hash, not an upstream one.
There are no hashes @ http://rpm5.org/files/popt/
Hence it's a "locally calculated" plus "i've also checked the mirror md5".
Regards.

[Buildroot] [PATCH 1/4] netstat-nat: add hash file

[Thomas Petazzoni]

Dear Gustavo Zacarias,

On Tue,  7 Jul 2015 09:52:29 -0300, Gustavo Zacarias wrote:
> Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
> ---
>  package/netstat-nat/netstat-nat.hash | 2 ++
>  1 file changed, 2 insertions(+)
>  create mode 100644 package/netstat-nat/netstat-nat.hash

All four patches applied, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com