Swatantra-66 commented on issue #3418:
URL: https://github.com/apache/nuttx-apps/issues/3418#issuecomment-6101316067
Hi @acassis,
I would like to take this up!
Looking into the repository, we actually already have
`apps/tools/check-hash.sh` in tree (added around NuttX 7.29), but currently
only 5 packages (`inih`, `psmq`, `embedlog`, `rtttl-c`, `morsey`) utilize it.
Flagship packages like LVGL, zlib, and others still download archives without
validation.
I propose the following approach:
1. **Enhance `apps/tools/check-hash.sh`**:
- Add `md5` support alongside `sha1|sha224|sha256|sha384|sha512`.
- Replace legacy `which` checks with POSIX `command -v`.
- Add a fallback to Python 3's `hashlib` if neither `<algo>sum` nor
`shasum` is available on the host build environment.
- Normalize hash comparison to be case-insensitive.
2. **Standardize Makefile & CMake Integration**:
- Define `CHECKHASH ?= $(APPDIR)/tools/check-hash.sh` centrally in
`apps/Make.defs` so individual Makefiles do not need ad-hoc tool paths.
- Allow optional hash overrides (e.g., `LVGL_SHA256 ?= ...`), skipping
validation gracefully only if an upstream hash is explicitly cleared or
pointing to an unversioned dev branch.
- Add matching `URL_HASH` validation in `CMakeLists.txt`
(`FetchContent_Declare`).
3. **Rollout**:
- Start with `graphics/lvgl` (and optionally `system/zlib`) as the
primary pilot PR, followed by rolling it out systematically to the remaining
external packages.
Please let me know if this plan looks good to you, and feel free to assign
this issue to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
