On Monday 06 July 2015 12:48:50 Nikolay Dimitrov wrote: > One issue with the regularly changing tarball checksums is that people > start to get used to thes changes (e.g. everything looks like false > positive). Currently the tarball checksums and SCM revisions are > probably the most important tool for builds traceability. If we get > used to think about these checksums as "unreliable", it will be much > easier to miss an important component change, which would otherwise > ring a bell.
Fully agreed. There are a couple of things I think we can do here: 1) Implement shallow cloning in bitbake's git fetcher as suggested. This shouldn't be too tricky. I've filed a bug to track this: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7958 (Richard is the default assignee, but anyone could potentially work on this). 2) In the mean time we could consider upload git mirror tarballs to a source mirror that gets enabled through meta-raspberrypi (would need to be via PREMIRRORS to actually solve the issue). This has the advantage that it wouldn't require any changes to the kernel recipe itself, but new tarballs would of course need to be uploaded every time SRCREV is changed in the recipe. Cheers, Paul -- Paul Eggleton Intel Open Source Technology Centre -- _______________________________________________ yocto mailing list yocto@yoctoproject.org https://lists.yoctoproject.org/listinfo/yocto