[Buildroot] [PATCH 10/12] pkg-infra: add possiblity to check downloaded files against known hashes

[Samuel Martin]

On Wed, Mar 5, 2014 at 10:47 PM, Yann E. MORIN <yann.morin.1998 at free.fr> wrote:
> From: "Yann E. MORIN" <yann.morin.1998 at free.fr>
>
> Some of the packages that Buildroot might build are sensitive packages,
> related to security: openssl, dropbear, ca-certificates...
>
> Some of those packages are downloaded over plain http, because there is
> no way to get them over a secure channel, such as https.
>
> In these dark times of pervasive surveillance, the potential for harm that
> a tampered-with package could generate, we may want to check the integrity
> of those sensitive packages.
>
> So, each package may now provide a list of hashes for all files that needs
> to be downloaded, and Buildroot will just fail if any downloaded file does
> not match its known hash, in which case it is removed.
>
> Hashes can be any of the md5, sha1 or sha2 variants, and will be checked
> even if the file was pre-downloaded.
>
> Signed-off-by: "Yann E. MORIN" <yann.morin.1998 at free.fr>
> Cc: Baruch Siach <baruch at tkos.co.il>
> Cc: Arnout Vandecappelle <arnout at mind.be>
> Cc: Gustavo Zacarias <gustavo at zacarias.com.ar>
>

Reviewed-by: Samuel Martin <s.martin49 at gmail.com>

Regards,

-- 
Samuel