Swatantra-66 opened a new pull request, #3833:
URL: https://github.com/apache/nuttx-apps/pull/3833
## Summary
This PR addresses #3418 by enhancing the centralized `tools/check-hash.sh`
script and integrating SHA256 checksum verification into `graphics/lvgl` and
`system/zlib` as pilot implementations.
1. **`tools/check-hash.sh` Enhancements**:
- Replaced legacy `which` checks with POSIX `command -v`.
- Maintained a 100% shell-based implementation using standard utilities
(`command -v`, `awk`, `tr`) without Python dependencies.
- Added support for `md5` alongside `sha1|sha224|sha256|sha384|sha512`
for legacy packages, while using SHA256+ for new and updated packages.
- Normalized hashes to lowercase using `tr '[:upper:]' '[:lower:]'` for
case-insensitive comparison.
- Added graceful bypass support when the expected hash is explicitly set
to `skip`, `none`, or empty.
- Automatically removes corrupted/tampered files (`rm -f`) upon mismatch
so subsequent build attempts re-download cleanly.
2. **`Make.defs` Centralization**:
- Defined `CHECKHASH ?= $(APPDIR)$(DELIM)tools$(DELIM)check-hash.sh`
under `# Tools` to standardize invocation across all apps Makefiles.
3. **`graphics/lvgl` & `system/zlib` Integration**:
- Added `LVGL_TARBALL_SHA256` and `ZLIB_TARBALL_SHA256` with `?=` to
allow user overrides.
- Validates checksums **both** upon download **and** immediately before
unpacking (ensuring pre-existing or cached archives cannot bypass verification).
- Added matching `URL_HASH SHA256=...` to CMake `FetchContent_Declare`.
Fixes #3418
## Impact
- **Security / Integrity**: Prevents corrupted, incomplete, or tampered
external archives from being unpacked and built into NuttX binaries.
- **Build Process**: Seamless. Fresh downloads and cached archives are
verified before extraction.
- **Compatibility**: 100% backward-compatible. Users can override hashes via
`<PKG>_TARBALL_SHA256` or bypass validation if using bleeding-edge unversioned
sources.
## Testing
- **Host**: Windows 11 x86_64 (Git Bash / POSIX sh)
- **Script Validation**:
- Exact SHA256 match -> Passes (exit code 0).
- Uppercase SHA256 match -> Passes (exit code 0).
- Explicit bypass (`skip` / `none`) -> Emits warning and passes (exit code
0).
- Mismatch / corrupted file -> Reports error, removes corrupted archive,
and fails (exit code 1).
- Cached archive verification prior to unpack -> Verified.
- **Code Style**:
- `tools/checkpatch.sh -p HEAD` -> 0 errors, 0 warnings.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
