Re: [meta-raspberrypi][PATCH] firmware.inc: Fetch a zip instead of cloning a git repo

[Paul Eggleton <paul.eggleton@linux.intel.com>]

On Monday 06 July 2015 12:48:50 Nikolay Dimitrov wrote:
> One issue with the regularly changing tarball checksums is that people
> start to get used to thes changes (e.g. everything looks like false
> positive). Currently the tarball checksums and SCM revisions are
> probably the most important tool for builds traceability. If we get
> used to think about these checksums as "unreliable", it will be much
> easier to miss an important component change, which would otherwise
> ring a bell.

Fully agreed.

There are a couple of things I think we can do here:

1) Implement shallow cloning in bitbake's git fetcher as suggested. This 
shouldn't be too tricky. I've filed a bug to track this:

  https://bugzilla.yoctoproject.org/show_bug.cgi?id=7958

(Richard is the default assignee, but anyone could potentially work on this).

2) In the mean time we could consider upload git mirror tarballs to a source 
mirror that gets enabled through meta-raspberrypi (would need to be via 
PREMIRRORS to actually solve the issue). This has the advantage that it 
wouldn't require any changes to the kernel recipe itself, but new tarballs 
would of course need to be uploaded every time SRCREV is changed in the 
recipe.

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre