diff mbox series

[v2,2/2] opkg: enable sha256 checksum verification by default

Message ID 20260730091017.171702-2-ecordonnier@snap.com
State Changes Requested
Headers show
Series [v2,1/2] package_manager/ipk: skip checksums for unsigned local feeds | expand

Commit Message

Etienne Cordonnier July 30, 2026, 9:10 a.m. UTC 
From: Etienne Cordonnier <ecordonnier@snap.com>

WITH_SHA256=ON adds no external dependency: sha256.c is a self-contained
528-line pure C implementation already present in the source tree.

oe-core already generates SHA256Sum fields in the Packages index
(via --checksum sha256 in OpkgIndexer.write_index), but opkg silently
ignores them unless compiled with WITH_SHA256=ON.  Enabling sha256 by
default makes those checksums actually verified at install time,
improving package integrity checking at zero dependency cost.

Once SHA256 is universally available, --checksum md5 can also be
dropped from OpkgIndexer.write_index() -- MD5 is collision-prone and
should not be relied upon for integrity checking -- completing the
deprecation noted in https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796
(2019).

AI-Generated: Claude Sonnet 4.6
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
---
 meta/recipes-devtools/opkg/opkg_0.10.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Paul Barker July 30, 2026, 11:52 a.m. UTC | #1 
On Thu, 2026-07-30 at 11:10 +0200, Etienne Cordonnier via
lists.openembedded.org wrote:
> From: Etienne Cordonnier <ecordonnier@snap.com>
> 
> WITH_SHA256=ON adds no external dependency: sha256.c is a self-contained
> 528-line pure C implementation already present in the source tree.
> 
> oe-core already generates SHA256Sum fields in the Packages index
> (via --checksum sha256 in OpkgIndexer.write_index), but opkg silently
> ignores them unless compiled with WITH_SHA256=ON.  Enabling sha256 by
> default makes those checksums actually verified at install time,
> improving package integrity checking at zero dependency cost.
> 
> Once SHA256 is universally available, --checksum md5 can also be
> dropped from OpkgIndexer.write_index() -- MD5 is collision-prone and
> should not be relied upon for integrity checking -- completing the
> deprecation noted in https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796
> (2019).
> 
> AI-Generated: Claude Sonnet 4.6
> Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>

Hi,

Claude likes to include irrelevant information in commit messages,
please re-write this one to focus on the relevant bits.

Otherwise this LGTM.

Best regards,
Etienne Cordonnier July 30, 2026, 12:10 p.m. UTC | #2 
hi Paul,
I've already manually revised the commit message to include the relevant
context justifying the increase in size of opkg. What should I remove?

 Étienne

On Thu, Jul 30, 2026 at 1:52 PM Paul Barker <paul@pbarker.dev> wrote:

> On Thu, 2026-07-30 at 11:10 +0200, Etienne Cordonnier via
> lists.openembedded.org wrote:
> > From: Etienne Cordonnier <ecordonnier@snap.com>
> >
> > WITH_SHA256=ON adds no external dependency: sha256.c is a self-contained
> > 528-line pure C implementation already present in the source tree.
> >
> > oe-core already generates SHA256Sum fields in the Packages index
> > (via --checksum sha256 in OpkgIndexer.write_index), but opkg silently
> > ignores them unless compiled with WITH_SHA256=ON.  Enabling sha256 by
> > default makes those checksums actually verified at install time,
> > improving package integrity checking at zero dependency cost.
> >
> > Once SHA256 is universally available, --checksum md5 can also be
> > dropped from OpkgIndexer.write_index() -- MD5 is collision-prone and
> > should not be relied upon for integrity checking -- completing the
> > deprecation noted in
> https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796
> > (2019).
> >
> > AI-Generated: Claude Sonnet 4.6
> > Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
>
> Hi,
>
> Claude likes to include irrelevant information in commit messages,
> please re-write this one to focus on the relevant bits.
>
> Otherwise this LGTM.
>
> Best regards,
>
> --
> Paul Barker
>
>
diff mbox series

Patch

diff --git a/meta/recipes-devtools/opkg/opkg_0.10.0.bb b/meta/recipes-devtools/opkg/opkg_0.10.0.bb
index debcd94a300..e3c2dd790dd 100644
--- a/meta/recipes-devtools/opkg/opkg_0.10.0.bb
+++ b/meta/recipes-devtools/opkg/opkg_0.10.0.bb
@@ -30,7 +30,7 @@  inherit cmake pkgconfig ptest
 target_localstatedir := "${localstatedir}"
 OPKGLIBDIR ??= "${target_localstatedir}/lib"
 
-PACKAGECONFIG ??= "libsolv ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}"
+PACKAGECONFIG ??= "libsolv sha256 ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}"
 
 PACKAGECONFIG[gpg] = "-DWITH_GPGME=ON,-DWITH_GPGME=OFF,\
     gnupg gpgme libgpg-error,\