Bug 4870

Summary: Allow indirect specification of checksums
Product: [Build System, Metadata & Runtime] BitBake Reporter: mulhern <mulhern>
Component: bitbakeAssignee: Richard Purdie <richard.purdie>
Status: RESOLVED FIXED QA Contact:
Severity: enhancement    
Priority: Low CC: poky.bs.watcher, poky.watcher, ross.burton, sgw
Version: unspecified   
Target Milestone: Future   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description mulhern 2013-07-19 01:22:40 UTC 
In some cases the provider of a file also makes the checksum available in a file.

Suggest allow specifying the location of the file that contains the checksum value, as well as the checksum value itself, in SRC_URI string.

The drawback of having the checksum value explicitly in the SRC_URI is that a rapidly changing checksum, say of a data file that may be updated every day, rather than of a source code tarball, that is generally updated less frequently, can not be accommodated.
Comment 1 Ross Burton 2017-06-13 11:42:10 UTC 
The checksum is used for both download validation (did this file download correctly?) and security (is this file the one I expected?).  Fetching the checksums from the remote server nullifies the security check so this isn't something that we'd want to support directly in oe-core, but if you're happy to compromise then there is a workaround.

Use a do_fetch prefunc (a function that executes before do_fetch runs) to set the checksums based on the remote file.  Here's a brief proof of concept:

SRC_URI = "https://download.gnome.org/sources/dates/0.4/dates-0.4.7.tar.bz2"
SHASUM_URI = "https://download.gnome.org/sources/dates/0.4/dates-0.4.7.sha256sum"

LICENSE = "GPLv2"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"

do_fetch[prefuncs] += "fetch_checksums"
python fetch_checksums() {
    import urllib
    for line in urllib.request.urlopen(d.getVar("SHASUM_URI")):
        (sha, filename) = line.decode("ascii").strip().split()
        if filename == "dates-0.4.7.tar.bz2":
            d.setVarFlag("SRC_URI", "sha256sum", sha)
            return
    bb.error("Could not find remote checksum")
}


Note that this recipe doesn't build but it does fetch, that's just the first small tarball I found.  There's quite a bit of hardcoding in there, the shamsum URL in the urlopen() call could be generated from the SRC_URI, and the basename in the looop could be extracted from the SRC_URI too.