Invalid checksums for SRC_URI ignored?

Invalid checksums for SRC_URI ignored?

[Michael Opdenacker]

Greetings,

I reused a simple "hello" recipe and added a non-matching checksum to it:

...
SRC_URI = "file://helloworld.c"
SRC_URI[md5sum] = "34f0efd76b4f18888888888833cdd129"
...

The rest of the recipe comes from
https://git.openembedded.org/openembedded-core/tree/meta-skeleton/recipes-skeleton/hello-single.

Why doesn't Bitbake stop, reporting that the checksum doesn't match the
source file?
Anyway, why does the recipe build without a checksum? Shouldn't
checksums be mandatory?

I'm using the "master" version of Poky.

Thanks in advance
Michael.

-- 
Michael Opdenacker, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [yocto] Invalid checksums for SRC_URI ignored?

[Ross Burton]

On Wed, 19 Jan 2022 at 12:16, Michael Opdenacker
<michael.opdenacker@bootlin.com> wrote:
>
> Greetings,
>
> I reused a simple "hello" recipe and added a non-matching checksum to it:
>
> ...
> SRC_URI = "file://helloworld.c"
> SRC_URI[md5sum] = "34f0efd76b4f18888888888833cdd129"
> ...
>
> The rest of the recipe comes from
> https://git.openembedded.org/openembedded-core/tree/meta-skeleton/recipes-skeleton/hello-single.
>
> Why doesn't Bitbake stop, reporting that the checksum doesn't match the
> source file?
> Anyway, why does the recipe build without a checksum? Shouldn't
> checksums be mandatory?

Checksums are for files that are fetched via http:// and friends, not
local files.

Ross

Re: [yocto] Invalid checksums for SRC_URI ignored?

[Peter Bergin]

Hi,

On 2022-01-19 13:16, Michael Opdenacker wrote:
> Greetings,
>
> I reused a simple "hello" recipe and added a non-matching checksum to it:
>
> ...
> SRC_URI = "file://helloworld.c"
> SRC_URI[md5sum] = "34f0efd76b4f18888888888833cdd129"
> ...
>
> The rest of the recipe comes from
> https://git.openembedded.org/openembedded-core/tree/meta-skeleton/recipes-skeleton/hello-single.
>
> Why doesn't Bitbake stop, reporting that the checksum doesn't match the
> source file?
> Anyway, why does the recipe build without a checksum? Shouldn't
> checksums be mandatory?

No they are not mandatory for all fetchers. They are only used for 
content downloaded from non-local archives. 
https://docs.yoctoproject.org/bitbake/bitbake-user-manual/bitbake-user-manual-fetching.html#the-download-fetch 


https://github.com/openembedded/bitbake/blob/32180d5057c818a69987aada482e82acf3c72ef2/lib/bb/fetch2/__init__.py#L1268

^^ here you can see the selection of URI's that automatically needs a 
checksum.

Best regards,
/Peter

Re: [yocto] Invalid checksums for SRC_URI ignored?

[Michael Opdenacker]

Peter, Ross

On 1/19/22 1:56 PM, Peter Bergin wrote:
> Hi,
>
> On 2022-01-19 13:16, Michael Opdenacker wrote:
>> Greetings,
>>
>> I reused a simple "hello" recipe and added a non-matching checksum to
>> it:
>>
>> ...
>> SRC_URI = "file://helloworld.c"
>> SRC_URI[md5sum] = "34f0efd76b4f18888888888833cdd129"
>> ...
>>
>> The rest of the recipe comes from
>> https://git.openembedded.org/openembedded-core/tree/meta-skeleton/recipes-skeleton/hello-single.
>>
>>
>> Why doesn't Bitbake stop, reporting that the checksum doesn't match the
>> source file?
>> Anyway, why does the recipe build without a checksum? Shouldn't
>> checksums be mandatory?
>
> No they are not mandatory for all fetchers. They are only used for
> content downloaded from non-local archives.
> https://docs.yoctoproject.org/bitbake/bitbake-user-manual/bitbake-user-manual-fetching.html#the-download-fetch
>
>
> https://github.com/openembedded/bitbake/blob/32180d5057c818a69987aada482e82acf3c72ef2/lib/bb/fetch2/__init__.py#L1268
>
>
> ^^ here you can see the selection of URI's that automatically needs a
> checksum.


Thanks for your replies. This all makes perfect sense then.
Thanks again
Michael.

-- 
Michael Opdenacker, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [yocto] Invalid checksums for SRC_URI ignored?

[Richard Purdie]

On Wed, 2022-01-19 at 14:59 +0100, Michael Opdenacker wrote:
> Peter, Ross
> 
> On 1/19/22 1:56 PM, Peter Bergin wrote:
> > Hi,
> > 
> > On 2022-01-19 13:16, Michael Opdenacker wrote:
> > > Greetings,
> > > 
> > > I reused a simple "hello" recipe and added a non-matching checksum to
> > > it:
> > > 
> > > ...
> > > SRC_URI = "file://helloworld.c"
> > > SRC_URI[md5sum] = "34f0efd76b4f18888888888833cdd129"
> > > ...
> > > 
> > > The rest of the recipe comes from
> > > https://git.openembedded.org/openembedded-core/tree/meta-skeleton/recipes-skeleton/hello-single.
> > > 
> > > 
> > > Why doesn't Bitbake stop, reporting that the checksum doesn't match the
> > > source file?
> > > Anyway, why does the recipe build without a checksum? Shouldn't
> > > checksums be mandatory?
> > 
> > No they are not mandatory for all fetchers. They are only used for
> > content downloaded from non-local archives.
> > https://docs.yoctoproject.org/bitbake/bitbake-user-manual/bitbake-user-manual-fetching.html#the-download-fetch
> > 
> > 
> > https://github.com/openembedded/bitbake/blob/32180d5057c818a69987aada482e82acf3c72ef2/lib/bb/fetch2/__init__.py#L1268
> > 
> > 
> > ^^ here you can see the selection of URI's that automatically needs a
> > checksum.
> 
> 
> Thanks for your replies. This all makes perfect sense then.

Personally, I think where the checksums are present, we should check them
regardless of url type though. I think I have an open bug related to this and
the uninative fetching.

Cheers,

Richard