diff mbox series

[2/2] opkg: enable sha256 checksum verification by default

Message ID 20260729152931.1347887-2-ecordonnier@snap.com
State New
Headers show
Series [1/2] package_manager/ipk: skip checksums for unsigned local feeds | expand

Commit Message

Etienne Cordonnier July 29, 2026, 3:29 p.m. UTC 
From: Etienne Cordonnier <ecordonnier@snap.com>

WITH_SHA256=ON adds no external dependency: sha256.c is a self-contained
528-line pure C implementation already present in the source tree.

oe-core already generates SHA256Sum fields in the Packages index
(via --checksum sha256 in OpkgIndexer.write_index), but opkg silently
ignores them unless compiled with WITH_SHA256=ON.  Enabling sha256 by
default makes those checksums actually verified at install time,
improving package integrity checking at zero dependency cost.

Once SHA256 is universally available, --checksum md5 can also be
dropped from OpkgIndexer.write_index() -- MD5 is collision-prone and
should not be relied upon for integrity checking -- completing the
deprecation noted in https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796
(2019).

AI-Generated: Claude Sonnet 4.6
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
---
 meta/recipes-devtools/opkg/opkg_0.10.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/opkg/opkg_0.10.0.bb b/meta/recipes-devtools/opkg/opkg_0.10.0.bb
index debcd94a300..e3c2dd790dd 100644
--- a/meta/recipes-devtools/opkg/opkg_0.10.0.bb
+++ b/meta/recipes-devtools/opkg/opkg_0.10.0.bb
@@ -30,7 +30,7 @@  inherit cmake pkgconfig ptest
 target_localstatedir := "${localstatedir}"
 OPKGLIBDIR ??= "${target_localstatedir}/lib"
 
-PACKAGECONFIG ??= "libsolv ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}"
+PACKAGECONFIG ??= "libsolv sha256 ${@bb.utils.filter('DISTRO_FEATURES', 'acl xattr', d)}"
 
 PACKAGECONFIG[gpg] = "-DWITH_GPGME=ON,-DWITH_GPGME=OFF,\
     gnupg gpgme libgpg-error,\