casaroli commented on code in PR #21497: URL: https://github.com/apache/nuttx/pull/21497#discussion_r4502591085
########## tools/ci/docker/linux/Dockerfile: ########## @@ -290,6 +290,19 @@ RUN mkdir -p riscv-none-elf-gcc && \ curl -s -L "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v14.3.0-1/xpack-riscv-none-elf-gcc-14.3.0-1-linux-x64.tar.gz"; \ | tar -C riscv-none-elf-gcc --strip-components 1 -xz +############################################################################### +# Build image for tool required by RH850 builds +############################################################################### +FROM nuttx-toolchain-base AS nuttx-toolchain-rh850 +# Download the RH850 GCC toolchain and qemu-system-rh850 prebuilt by Linumiz +RUN mkdir -p v850-elf-gcc && \ + curl -s -L --fail "https://github.com/linumiz/rh850-gcc-toolchain/releases/download/v1.0.0/v850-elf-toolchain-linux-x86_64.tar.gz"; \ Review Comment: This downloads GPL binaries (GCC 14.3.0, binutils 2.43.1, GDB 16.2 "with one v850 frame id fix", per its README) that the CI image then redistributes. linumiz/rh850-gcc-toolchain has no licence, no build script for v1.0.0 and no source archive in the release, so the source of these binaries, and of the GDB fix, is not published. Fix: publish the corresponding source (or a build script with the exact upstream versions and every patch) with the release, and link it in the commit message. ########## tools/ci/docker/linux/Dockerfile: ########## @@ -290,6 +290,19 @@ RUN mkdir -p riscv-none-elf-gcc && \ curl -s -L "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v14.3.0-1/xpack-riscv-none-elf-gcc-14.3.0-1-linux-x64.tar.gz"; \ | tar -C riscv-none-elf-gcc --strip-components 1 -xz +############################################################################### +# Build image for tool required by RH850 builds +############################################################################### +FROM nuttx-toolchain-base AS nuttx-toolchain-rh850 +# Download the RH850 GCC toolchain and qemu-system-rh850 prebuilt by Linumiz +RUN mkdir -p v850-elf-gcc && \ + curl -s -L --fail "https://github.com/linumiz/rh850-gcc-toolchain/releases/download/v1.0.0/v850-elf-toolchain-linux-x86_64.tar.gz"; \ + | tar -C v850-elf-gcc -xz && \ + rm -rf v850-elf-gcc/share +RUN mkdir -p qemu-rh850 && \ + curl -s -L --fail "https://github.com/linumiz/qemu-rh850/releases/download/v1.0.0/qemu-rh850-linux-x86_64.tar.gz"; \ Review Comment: Neither v1.0.0 release is immutable, so both archives can be replaced under the same URL, and nothing checks what is downloaded (here and in linux.sh and ubuntu.sh). Fix: check the SHA-256 of both archives after the download, in the Dockerfile, linux.sh and ubuntu.sh: ebde4413abe7d7be944e8cc2440522ed3af0f6c521858243c4baf4b791d5b88f for v850-elf-toolchain-linux-x86_64.tar.gz, df6d864f0d707093b9db34f6db5ba9865a4c65eea160ae567f43ad1ad6e91700 for qemu-rh850-linux-x86_64.tar.gz. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
