Re: [Buildroot] [PATCH] utils/check-package: new check for Buildroot's defconfig files

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Thomas" == Thomas Petazzoni via buildroot <buildroot@buildroot.org> writes:

 > On Sun, 31 Mar 2024 22:34:03 +0200
 > "Yann E. MORIN" <yann.morin.1998@free.fr> wrote:

 >> Now that we do have support for checking hashes for custom versions
 >> (for the few packages for which we do support custom versions, like the
 >> kernel, some bootloaders...), we want to ensure that our defconfig
 >> files, when they enable one or more such custom version, do enable
 >> checking the hashes for those versions, and thus we want to require all
 >> our defconfigs do enable BR2_DOWNLOAD_FORCE_CHECK_HASHES.
 >> 
 >> Add a check for that condition.
 >> 
 >> We need to be careful that we only check Buildroot's defconfig, whether
 >> in-tree or in a br2-external, and not kernel or other kconfig-based
 >> defconfig files, like those in board/ sub-directories. So we only match
 >> defconfig files that are in a configs/ directory, whether at the
 >> toplevel (for in-tree defconfigs), or not (for br2-external defconfigs).

I wonder if it really makes sense to enforce this for br2-external
defconfigs, as it is basically a question about policy and they are "out of
our hands". Depending on the use case it may or may not make sense for
those defconfigs to use hashes.

E.G. at $WORK I have a br2-external tree where check-package is used to
ensure that the packages are well behaved (E.G. do not negatively impact
the rest), but E.G. the kernel is downloaded from a trusted git server
and changed often, so the overhead of maintaining hashes of the
(buildroot internally generated) tarball is quite annoying.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot