Re: [OE-core] [PATCH] dtc: update to 1.6.0

["Richard Leitner" <richard.leitner@skidata.com>]

On Wed, May 06, 2020 at 10:10:16AM +0300, Adrian Bunk wrote:
> On Tue, May 05, 2020 at 01:55:35PM +0200, Richard Leitner wrote:
> >...
> > --- a/meta/recipes-kernel/dtc/dtc_1.5.1.bb
> > +++ b/meta/recipes-kernel/dtc/dtc_1.6.0.bb
> > @@ -3,7 +3,7 @@ require dtc.inc
> >  LIC_FILES_CHKSUM = "file://GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> >  		    file://libfdt/libfdt.h;beginline=4;endline=7;md5=05bb357cfb75cae7d2b01d2ee8d76407"
> >  
> > -SRCREV = "60e0db3d65a1218b0d5a29474e769f28a18e3ca6"
> > +SRCREV = "v${PV}"
> >...
> 
> It is tempting to use tags, but it is a bad idea.
> Upstream might move a tag to a different commit.
> Someone might do a man-in-the-middle attack on a specific user,
> and there is no other verification of the sources apart from
> the commit hash.

Thanks for the info. Is this documented somewhere?

How should I proceed on this patch as it was already applied to
master-next? Should I send a v2 or a "fix patch"?

Furthermore I'll send a v2 for my other series which is not applied yet
(https://patchwork.openembedded.org/patch/172341/).

regards;rl

> 
> cu
> Adrian