4870 2013-07-19 01:22:40 +0000 Allow indirect specification of checksums 2017-06-13 11:42:10 +0000 1 1 7 Build System, Metadata & Runtime BitBake bitbake unspecified All Multiple RESOLVED FIXED Low enhancement Future 1 mulhern richard.purdie poky.bs.watcher poky.watcher ross.burton sgw --- --- No (bug/feature does not impact docs) oldest_to_newest 34688 0 mulhern 2013-07-19 01:22:40 +0000 In some cases the provider of a file also makes the checksum available in a file. Suggest allow specifying the location of the file that contains the checksum value, as well as the checksum value itself, in SRC_URI string. The drawback of having the checksum value explicitly in the SRC_URI is that a rapidly changing checksum, say of a data file that may be updated every day, rather than of a source code tarball, that is generally updated less frequently, can not be accommodated. 74063 1 ross.burton 2017-06-13 11:42:10 +0000 The checksum is used for both download validation (did this file download correctly?) and security (is this file the one I expected?). Fetching the checksums from the remote server nullifies the security check so this isn't something that we'd want to support directly in oe-core, but if you're happy to compromise then there is a workaround. Use a do_fetch prefunc (a function that executes before do_fetch runs) to set the checksums based on the remote file. Here's a brief proof of concept: SRC_URI = "https://download.gnome.org/sources/dates/0.4/dates-0.4.7.tar.bz2" SHASUM_URI = "https://download.gnome.org/sources/dates/0.4/dates-0.4.7.sha256sum" LICENSE = "GPLv2" LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" do_fetch[prefuncs] += "fetch_checksums" python fetch_checksums() { import urllib for line in urllib.request.urlopen(d.getVar("SHASUM_URI")): (sha, filename) = line.decode("ascii").strip().split() if filename == "dates-0.4.7.tar.bz2": d.setVarFlag("SRC_URI", "sha256sum", sha) return bb.error("Could not find remote checksum") } Note that this recipe doesn't build but it does fetch, that's just the first small tarball I found. There's quite a bit of hardcoding in there, the shamsum URL in the urlopen() call could be generated from the SRC_URI, and the basename in the looop could be extracted from the SRC_URI too.