ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-19 05:38:00 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

download: handle possibly invalid local tarballs

Browse Source 
Currently it's assumed, that already downloaded tarballs are always
fine, so no checksum checking is performed and the tarball is used even
if it might be corrupted.

From now on, we're going to always check the downloaded tarballs before
considering them valid.

Steps to reproduce:

 1. Remove cached tarball

   rm dl/libubox-2020-08-06-9e52171d.tar.xz

 2. Download valid tarball again

   make package/libubox/download

 3. Invalidate the tarball

   sed -i 's/PKG_MIRROR_HASH:=../PKG_MIRROR_HASH:=ff/' package/libs/libubox/Makefile

 4. Now compile with corrupt tarball source

   make package/libubox/{clean,compile}

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 4e19cbc553)
This commit is contained in:
Petr Štetiar 2020-11-19 16:32:46 +01:00
parent 5abe989475
commit 605adb1023
3 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/host-build.mk
View File

@ -184,6 +184,8 @@ ifndef DUMP
clean-build: host-clean-build
endif
$(DL_DIR)/$(FILE): FORCE
$(_host_target)host-prepare: $(HOST_STAMP_PREPARED)
$(_host_target)host-configure: $(HOST_STAMP_CONFIGURED)
$(_host_target)host-compile: $(HOST_STAMP_BUILT) $(HOST_STAMP_INSTALLED)

2
include/package.mk
View File

@ -185,6 +185,8 @@ define Build/CoreTargets
$(call Build/Autoclean)
$(call DefaultTargets)
$(DL_DIR)/$(FILE): FORCE
download:
$(foreach hook,$(Hooks/Download),
$(call $(hook))$(sep)

18
scripts/download.pl
View File

@ -263,6 +263,24 @@ foreach my $mirror (@ARGV) {
push @mirrors, 'https://sources.openwrt.org';
push @mirrors, 'https://mirror2.openwrt.org/sources';
if (-f "$target/$filename") {
$hash_cmd and do {
if (system("cat '$target/$filename' | $hash_cmd > '$target/$filename.hash'")) {
die "Failed to generate hash for $filename\n";
}
my $sum = `cat "$target/$filename.hash"`;
$sum =~ /^(\w+)\s*/ or die "Could not generate file hash\n";
$sum = $1;
exit 0 if $sum eq $file_hash;
die "Hash of the local file $filename does not match (file: $sum, requested: $file_hash) - deleting download.\n";
unlink "$target/$filename";
cleanup();
};
}
while (!-f "$target/$filename") {
my $mirror = shift @mirrors;
$mirror or die "No more mirrors to try - giving up.\n";