This is an automated email from the ASF dual-hosted git repository.
acassis pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
The following commit(s) were added to refs/heads/master by this push:
new 871bb49f3 tools/check-hash: add checksum validation for external
downloads
871bb49f3 is described below
commit 871bb49f394f365b912755cc916ed68cde9c7963
Author: Swatantra Yadav <[email protected]>
AuthorDate: Sun Oct 11 15:56:32 2026 +0530
tools/check-hash: add checksum validation for external downloads
Enhance tools/check-hash.sh and integrate automated hash checking for
external downloads:
1. tools/check-hash.sh:
- Replace which with POSIX command -v.
- Support md5 alongside sha1/sha224/sha256/sha384/sha512.
- Keep 100% shell-based (command -v, awk) without Python dependencies.
- Normalize hashes to lowercase for case-insensitive comparison.
- Support optional bypass when expected hash is empty, "none", or "skip".
- Remove corrupted downloads on hash mismatch.
2. Make.defs:
- Centralize CHECKHASH (?= $(APPDIR)$(DELIM)tools$(DELIM)check-hash.sh).
3. graphics/lvgl & system/zlib:
- Add SHA256 validation both on download and prior to unpacking.
- Add matching URL_HASH in CMakeLists.txt (FetchContent_Declare).
Fixes #3418.
Signed-off-by: Swatantra Yadav <[email protected]>
---
Make.defs | 1 +
graphics/lvgl/CMakeLists.txt | 7 +++++++
graphics/lvgl/Makefile | 10 +++++++++
system/zlib/CMakeLists.txt | 7 +++++--
system/zlib/Makefile | 7 +++++++
tools/check-hash.sh | 50 +++++++++++++++++++++++++++++++++++---------
6 files changed, 70 insertions(+), 12 deletions(-)
diff --git a/Make.defs b/Make.defs
index c463006cb..4a2dcfa48 100644
--- a/Make.defs
+++ b/Make.defs
@@ -95,6 +95,7 @@ ifeq ($(CONFIG_WINDOWS_NATIVE),y)
else
MKKCONFIG ?= $(APPDIR)$(DELIM)tools$(DELIM)mkkconfig.sh
endif
+CHECKHASH ?= $(APPDIR)$(DELIM)tools$(DELIM)check-hash.sh
# Builtin Registration
diff --git a/graphics/lvgl/CMakeLists.txt b/graphics/lvgl/CMakeLists.txt
index c6ba90ef5..5551920aa 100644
--- a/graphics/lvgl/CMakeLists.txt
+++ b/graphics/lvgl/CMakeLists.txt
@@ -34,9 +34,16 @@ if(CONFIG_GRAPHICS_LVGL)
if(NOT EXISTS ${LVGL_DIR})
set(LVGL_URL
"https://github.com/lvgl/lvgl/archive/refs/tags/v${LVGL_VERSION}.zip";)
+ if("${LVGL_VERSION}" STREQUAL "9.2.2")
+ set(LVGL_URL_HASH
+ URL_HASH
+
SHA256=b3d33f7aad1360f588762208d0f563574392debbc28d9187bda86012909f2203
+ )
+ endif()
FetchContent_Declare(
lvgl_fetch
URL ${LVGL_URL}
+ ${LVGL_URL_HASH}
DOWNLOAD_DIR
${CMAKE_CURRENT_LIST_DIR}
SOURCE_DIR
diff --git a/graphics/lvgl/Makefile b/graphics/lvgl/Makefile
index ce9ad6b7f..6bd8e2d1a 100644
--- a/graphics/lvgl/Makefile
+++ b/graphics/lvgl/Makefile
@@ -64,6 +64,10 @@ _PAT := $(CONFIG_LVGL_VERSION_PATCH)
LVGL_VERSION := $(_MAJ).$(_MIN).$(_PAT)
LVGL_TARBALL := v$(LVGL_VERSION).zip
+ifeq ($(LVGL_VERSION),9.2.2)
+LVGL_TARBALL_SHA256 ?=
b3d33f7aad1360f588762208d0f563574392debbc28d9187bda86012909f2203
+endif
+
LVGL_UNPACKNAME = lvgl
UNPACK ?= unzip -o $(if $(V),,-q)
CURL ?= curl -L -O $(if $(V),,-Ss)
@@ -73,10 +77,16 @@ LVGL_UNPACKDIR = $(WD)/$(LVGL_UNPACKNAME)
$(LVGL_TARBALL):
$(ECHO_BEGIN)"Downloading: $(LVGL_TARBALL)"
$(Q) $(CURL) $(CONFIG_GRAPH_LVGL_URL)/$(LVGL_TARBALL)
+ifneq ($(LVGL_TARBALL_SHA256),)
+ $(Q) $(CHECKHASH) sha256 $(LVGL_TARBALL_SHA256) $(LVGL_TARBALL)
+endif
$(ECHO_END)
$(LVGL_UNPACKNAME): $(LVGL_TARBALL)
$(ECHO_BEGIN)"Unpacking: $(LVGL_TARBALL) -> $(LVGL_UNPACKNAME)"
+ifneq ($(LVGL_TARBALL_SHA256),)
+ $(Q) $(CHECKHASH) sha256 $(LVGL_TARBALL_SHA256) $(LVGL_TARBALL)
+endif
$(Q) $(UNPACK) $(LVGL_TARBALL)
$(Q) mv lvgl-$(LVGL_VERSION) $(LVGL_UNPACKNAME)
$(Q) touch $(LVGL_UNPACKNAME)
diff --git a/system/zlib/CMakeLists.txt b/system/zlib/CMakeLists.txt
index 1a7bb24ae..e8149193b 100644
--- a/system/zlib/CMakeLists.txt
+++ b/system/zlib/CMakeLists.txt
@@ -31,10 +31,13 @@ if(CONFIG_LIB_ZLIB)
if(NOT EXISTS ${ZLIB_DIR})
set(ZLIB_URL
https://github.com/madler/zlib/releases/download/v1.3/zlib13.zip)
+ set(ZLIB_URL_HASH
+ URL_HASH
+
SHA256=c561d09347f674f0d72692e7c75d9898919326c532aab7f8c07bb43b07efeb38)
FetchContent_Declare(
zlib_fetch
- URL ${ZLIB_URL} SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR}/zlib BINARY_DIR
- ${NUTTX_BINARY_DIR}/apps/system/zlib/zlib
+ URL ${ZLIB_URL} ${ZLIB_URL_HASH} SOURCE_DIR
${CMAKE_CURRENT_LIST_DIR}/zlib
+ BINARY_DIR ${NUTTX_BINARY_DIR}/apps/system/zlib/zlib
DOWNLOAD_NO_PROGRESS true
TIMEOUT 30)
diff --git a/system/zlib/Makefile b/system/zlib/Makefile
index 711f3bd2e..e1c93855c 100644
--- a/system/zlib/Makefile
+++ b/system/zlib/Makefile
@@ -35,16 +35,23 @@ zlib/test/infcover.c_CFLAGS += -Wno-format
ZLIB_ZIP = zlib13.zip
ZLIB_SRC = zlib
+ZLIB_TARBALL_SHA256 ?=
c561d09347f674f0d72692e7c75d9898919326c532aab7f8c07bb43b07efeb38
ifeq ($(wildcard zlib/.git),)
$(ZLIB_ZIP):
@echo "Downloading: $(ZLIB_ZIP)"
$(Q) curl -O -L
https://github.com/madler/zlib/releases/download/v1.3/zlib13.zip
+ifneq ($(ZLIB_TARBALL_SHA256),)
+ $(Q) $(CHECKHASH) sha256 $(ZLIB_TARBALL_SHA256) $(ZLIB_ZIP)
+endif
# Make zconf.h include unistd.h, as zlib's configure does on Unix:
# gzlib.c, gzread.c and gzwrite.c use lseek(), read() and write().
$(ZLIB_SRC) : $(ZLIB_ZIP)
+ifneq ($(ZLIB_TARBALL_SHA256),)
+ $(Q) $(CHECKHASH) sha256 $(ZLIB_TARBALL_SHA256) $(ZLIB_ZIP)
+endif
unzip -o $(ZLIB_ZIP)
mv zlib-1.3 $(ZLIB_SRC)
sed -i.orig "/^#ifdef HAVE_UNISTD_H.* may be/s/def HAVE_UNISTD_H\(.*\)
may be/ 1\1 was/" $(ZLIB_SRC)/zconf.h
diff --git a/tools/check-hash.sh b/tools/check-hash.sh
index f20e07d6b..6b69ea10e 100755
--- a/tools/check-hash.sh
+++ b/tools/check-hash.sh
@@ -43,33 +43,63 @@ if [ ! -f "${file_to_check}" ]; then
fi
case "${hash_algo}" in
- sha1|sha224|sha256|sha384|sha512)
+ sha1|sha224|sha256|sha384|sha512|md5)
# valid hash passed, continue
;;
*)
echo "ERROR: invalid hash '${hash_algo}' for file '${file_to_check}'"
echo "supported hashes are:"
- echo " sha1, sha224, sha256, sha384, sha512"
+ echo " sha1, sha224, sha256, sha384, sha512, md5"
echo ""
echo ${usage}
exit 1
esac
+# If expected hash is explicitly set to skip or empty, allow bypass
+
+if [ -z "${exp_hash}" ] || [ "${exp_hash}" = "none" ] || [ "${exp_hash}" =
"skip" ]; then
+ echo "WARNING: hash check skipped for '${file_to_check}'"
+ exit 0
+fi
+
# Calculate hash value of passed file
-if [ `which ${hash_algo}sum 2> /dev/null` ]; then
- hash_algo_cmd="${hash_algo}sum"
-elif [ `which shasum 2> /dev/null` ]; then
- hash_algo_len=$(echo ${hash_algo} | cut -c 4-)
- hash_algo_cmd="shasum -a ${hash_algo_len}"
+hash_algo_cmd=""
+if [ "${hash_algo}" = "md5" ]; then
+ if command -v md5sum > /dev/null 2>&1; then
+ hash_algo_cmd="md5sum"
+ elif command -v md5 > /dev/null 2>&1; then
+ hash_algo_cmd="md5 -q"
+ elif command -v openssl > /dev/null 2>&1; then
+ hash_algo_cmd="openssl dgst -md5 -r"
+ fi
+else
+ if command -v "${hash_algo}sum" > /dev/null 2>&1; then
+ hash_algo_cmd="${hash_algo}sum"
+ elif command -v shasum > /dev/null 2>&1; then
+ hash_algo_len=$(echo "${hash_algo}" | cut -c 4-)
+ hash_algo_cmd="shasum -a ${hash_algo_len}"
+ elif command -v openssl > /dev/null 2>&1; then
+ hash_algo_cmd="openssl dgst -${hash_algo} -r"
+ fi
fi
-calc_hash=$(${hash_algo_cmd} "${file_to_check}" | cut -d' ' -f1)
+if [ -z "${hash_algo_cmd}" ]; then
+ echo "ERROR: no suitable hash tool found for '${hash_algo}'"
+ exit 1
+fi
+
+calc_hash=$(${hash_algo_cmd} "${file_to_check}" | awk '{print $1}')
+
+# Normalize hashes to lowercase for case-insensitive comparison
+
+exp_hash=$(echo "${exp_hash}" | tr '[:upper:]' '[:lower:]')
+calc_hash=$(echo "${calc_hash}" | tr '[:upper:]' '[:lower:]')
# Does it match expected hash?
-if [ "${exp_hash}" == "${calc_hash}" ]; then
+if [ "${exp_hash}" = "${calc_hash}" ]; then
# yes, they match, we're good
exit 0
fi
@@ -79,5 +109,5 @@ fi
echo "ERROR: file ${file_to_check} has invalid hash"
echo "got: ${calc_hash}"
echo "expected: ${exp_hash}"
-rm "${file_to_check}"
+rm -f "${file_to_check}"
exit 1
