Re: [Buildroot] [PATCH next] package/hiawatha: update to 11.6

[Waldemar Brodkorb <wbx@openadk.org>]

Hi Thomas,
Thomas Petazzoni wrote,

> Hello Waldemar,
> 
> On Sun, 11 Aug 2024 07:25:20 +0200
> Waldemar Brodkorb <wbx@openadk.org> wrote:
> 
> > See here for a changelog:
> > https://hiawatha.leisink.net/changelog
> > 
> > Update Config.in to use the new homepage.
> > Update download site to use the new homepage.
> > 
> > Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
> > ---
> >  package/hiawatha/Config.in     | 2 +-
> >  package/hiawatha/hiawatha.hash | 2 +-
> >  package/hiawatha/hiawatha.mk   | 4 ++--
> >  3 files changed, 4 insertions(+), 4 deletions(-)
> 
> You're going to hate me, but this bump also doesn't build.
> 
> Try to build:
> 
> BR2_arm=y
> BR2_cortex_a9=y
> BR2_ARM_ENABLE_VFP=y
> BR2_TOOLCHAIN_EXTERNAL=y
> BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
> BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_MUSL_STABLE=y
> BR2_INIT_NONE=y
> BR2_SYSTEM_BIN_SH_NONE=y
> # BR2_PACKAGE_BUSYBOX is not set
> BR2_PACKAGE_HIAWATHA=y
> # BR2_TARGET_ROOTFS_TAR is not set
> 
> Successful before your bump, fails after your bump.

I only tested with TLS on, sorry.

It seems upstream is broken regarding ENABLE_TLS=OFF.
I tried to patch CMakeFiles.txt to add the missing sha3.c, but then
other symbols are missing. I added 5 missing files and still no go.
Uptream is not very active anymore, he mentions on his website that
he is doing releases, but no active development anymore.

We could remove TLS off case entirely and still have a small secure
webserver. What do you think?

> Also, it is worth nothing that there is also an issue with the 11.2
> version of hiawatha: the hash we have in Buildroot no longer matches
> the one from the upstream tarball:
> 
> ERROR: while checking hashes from package/hiawatha/hiawatha.hash
> ERROR: hiawatha-11.2.tar.gz has wrong sha256 hash:
> ERROR: expected: 99c64f76927f93469f062ab76b74eb79a397ea4be12da86bf746b2bb57cf1bc5
> ERROR: got     : e00a659225b5f201b1fd81014277bcfe96da476a165f92fc057f3d7036c8b993
> ERROR: Incomplete download, or man-in-the-middle (MITM) attack
> 
> It "works" because we fallback to sources.buildroot.net, which has the
> "right" tarball, but it would be nice to understand what's going on.
> 
> Could you have a look?

It is because the old URL is no longer available and a html is
downloaded instead of the tar.gz.

best regards
 Waldemar
 
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot