In some cases the provider of a file also makes the checksum available in a file. Suggest allow specifying the location of the file that contains the checksum value, as well as the checksum value itself, in SRC_URI string. The drawback of having the checksum value explicitly in the SRC_URI is that a rapidly changing checksum, say of a data file that may be updated every day, rather than of a source code tarball, that is generally updated less frequently, can not be accommodated.
The checksum is used for both download validation (did this file download correctly?) and security (is this file the one I expected?). Fetching the checksums from the remote server nullifies the security check so this isn't something that we'd want to support directly in oe-core, but if you're happy to compromise then there is a workaround. Use a do_fetch prefunc (a function that executes before do_fetch runs) to set the checksums based on the remote file. Here's a brief proof of concept: SRC_URI = "https://download.gnome.org/sources/dates/0.4/dates-0.4.7.tar.bz2" SHASUM_URI = "https://download.gnome.org/sources/dates/0.4/dates-0.4.7.sha256sum" LICENSE = "GPLv2" LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" do_fetch[prefuncs] += "fetch_checksums" python fetch_checksums() { import urllib for line in urllib.request.urlopen(d.getVar("SHASUM_URI")): (sha, filename) = line.decode("ascii").strip().split() if filename == "dates-0.4.7.tar.bz2": d.setVarFlag("SRC_URI", "sha256sum", sha) return bb.error("Could not find remote checksum") } Note that this recipe doesn't build but it does fetch, that's just the first small tarball I found. There's quite a bit of hardcoding in there, the shamsum URL in the urlopen() call could be generated from the SRC_URI, and the basename in the looop could be extracted from the SRC_URI too.