[PATCH] ethtool: Switch to download mirror

[PATCH] ethtool: Switch to download mirror

[Paul Barker]

The md5sum & sha256sum for ethtool-4.8.tar.gz have changed upstream :(

Signed-off-by: Paul Barker <pbarker@toganlabs.com>
---
 meta/recipes-extended/ethtool/ethtool_4.8.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/ethtool/ethtool_4.8.bb b/meta/recipes-extended/ethtool/ethtool_4.8.bb
index 4ca88d766c..afaf2e2f71 100644
--- a/meta/recipes-extended/ethtool/ethtool_4.8.bb
+++ b/meta/recipes-extended/ethtool/ethtool_4.8.bb
@@ -6,7 +6,7 @@ LICENSE = "GPLv2+"
 LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
                     file://ethtool.c;beginline=4;endline=17;md5=c19b30548c582577fc6b443626fc1216"
 
-SRC_URI = "${KERNELORG_MIRROR}/software/network/ethtool/ethtool-${PV}.tar.gz \
+SRC_URI = "https://downloads.yoctoproject.org/mirror/sources/ethtool-${PV}.tar.gz \
            file://run-ptest \
            file://avoid_parallel_tests.patch \
            "
-- 
2.11.0

Re: [PATCH] ethtool: Switch to download mirror

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 228 bytes --]

On 2 April 2017 at 22:31, Paul Barker <pbarker@toganlabs.com> wrote:

> The md5sum & sha256sum for ethtool-4.8.tar.gz have changed upstream :(
>

Have you verified with upstream that they haven't been compromised?

Ross

[-- Attachment #2: Type: text/html, Size: 644 bytes --]

Re: [PATCH] ethtool: Switch to download mirror

[Paul Barker]

On Mon, 3 Apr 2017 09:57:15 +0100
"Burton, Ross" <ross.burton@intel.com> wrote:

> On 2 April 2017 at 22:31, Paul Barker <pbarker@toganlabs.com> wrote:
> 
> > The md5sum & sha256sum for ethtool-4.8.tar.gz have changed upstream :(
> >  
> 
> Have you verified with upstream that they haven't been compromised?
> 
> Ross

I've sent an email to confirm. I'll report back when I get a reply.

Cheers,
Paul

Re: [PATCH] ethtool: Switch to download mirror

[Leonardo Sandoval]

On Sun, 2017-04-02 at 22:31 +0100, Paul Barker wrote:
> The md5sum & sha256sum for ethtool-4.8.tar.gz have changed upstream :(

so why the sums are not changed in the recipe if these change at the
upstream repo?

Leo

> 
> Signed-off-by: Paul Barker <pbarker@toganlabs.com>
> ---
>  meta/recipes-extended/ethtool/ethtool_4.8.bb | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-extended/ethtool/ethtool_4.8.bb b/meta/recipes-extended/ethtool/ethtool_4.8.bb
> index 4ca88d766c..afaf2e2f71 100644
> --- a/meta/recipes-extended/ethtool/ethtool_4.8.bb
> +++ b/meta/recipes-extended/ethtool/ethtool_4.8.bb
> @@ -6,7 +6,7 @@ LICENSE = "GPLv2+"
>  LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
>                      file://ethtool.c;beginline=4;endline=17;md5=c19b30548c582577fc6b443626fc1216"
>  
> -SRC_URI = "${KERNELORG_MIRROR}/software/network/ethtool/ethtool-${PV}.tar.gz \
> +SRC_URI = "https://downloads.yoctoproject.org/mirror/sources/ethtool-${PV}.tar.gz \
>             file://run-ptest \
>             file://avoid_parallel_tests.patch \
>             "
> -- 
> 2.11.0
> 

Re: [PATCH] ethtool: Switch to download mirror

[Burton, Ross]

[-- Attachment #1: Type: text/plain, Size: 300 bytes --]

On 3 April 2017 at 16:39, Leonardo Sandoval <
leonardo.sandoval.gonzalez@linux.intel.com> wrote:

> so why the sums are not changed in the recipe if these change at the
> upstream repo?
>

Because the patch changes the SRC_URI to point at our mirror, which
contains the old tarball.

Ross

[-- Attachment #2: Type: text/html, Size: 728 bytes --]

Re: [PATCH] ethtool: Switch to download mirror

[Paul Barker]

On Mon, 3 Apr 2017 09:57:15 +0100
"Burton, Ross" <ross.burton@intel.com> wrote:

> On 2 April 2017 at 22:31, Paul Barker <pbarker@toganlabs.com> wrote:
> 
> > The md5sum & sha256sum for ethtool-4.8.tar.gz have changed upstream :(
> >  
> 
> Have you verified with upstream that they haven't been compromised?
> 
> Ross

Now verified with upstream:

On Wed, 5 Apr 2017 10:00:04 -0400
"John W. Linville" <linville@tuxdriver.com> wrote:

> Yes, the .tar.gz file got regenerated locally as I was tinkering with
> the release scripts that I inherited from the former ethtool maintainer,
> and the regenerated .tar.gz file got uploaded. The newly updated one
> is properly signed and the signature is there to verify. (Note that
> the signature is against the .tar file and not the .tar.gz file.)

Looks like this has already been merged to master anyway but good to
have that confirmation.

Cheers,
Paul