Message-ID: <1526464403.32156.13.camel@andred.net>
From: =?ISO-8859-1?Q?Andr=E9?= Draszik <git@andred.net>
To: "Burton, Ross" <ross.burton@intel.com>
Date: Wed, 16 May 2018 10:53:23 +0100
In-Reply-To: <CAJTo0LZ2G_4cMxoAQm2AWgRnkeP5VXRURH9c82qaBpA0bop59A@mail.gmail.com>
References: <20180503094308.7549-1-mac@mcrowe.com>
	<20180504183725.22134-1-mac@mcrowe.com>
	<CAJTo0LZ2G_4cMxoAQm2AWgRnkeP5VXRURH9c82qaBpA0bop59A@mail.gmail.com>
Mime-Version: 1.0
Cc: OpenEmbedded Devel List <openembedded-devel@lists.openembedded.org>,
	Mike Crowe <mac@mcrowe.com>
Subject: Re: [meta-java][PATCHv2] jdepend: Retrieve source from Git rather than tarball
Precedence: list
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit

Would it be useful to add a check to patchreview.py (or elsewhere?) to
reject patches that contain references to github archive URLs in the recipe?

Cheers,
Andre'

On Tue, 2018-05-08 at 10:28 +0100, Burton, Ross wrote:
> http://lists.openembedded.org/pipermail/openembedded-devel/2017-September/
> 114916.html,
> fwiw
> 
> Ross
> 
> On 4 May 2018 at 19:37, Mike Crowe <mac@mcrowe.com> wrote:
> 
> > When Bitbake downloads jdepend-2.9.1.zip itself and I download
> > https://github.com/clarkware/jdepend/blob/master/dist/jdepend-2.9.1.zip
> > ,
> > the calculated hashes don't match the ones included in the recipe.
> > 
> > The hashes were last changed in commit
> > dd5c43fca8289b8795a9214aee616775e1493109 on 1st March, but GitHub claims
> > that the file being downloaded was published on 20th January, so I can't
> > explain why they are wrong.
> > 
> > It seems that we can't really rely on these tarballs to remain
> > unchanged,
> > so let's download the Git hash that corresponds to v2.9.1 instead. This
> > should always remain valid.
> > 
> > Cc: André Draszik <andre.draszik@jci.com>
> > Cc: Khem Raj <raj.khem@gmail.com>
> > Signed-off-by: Mike Crowe <mac@mcrowe.com>
> > ---
> >  recipes-core/jdepend/jdepend_2.9.1.bb | 7 +++----
> >  1 file changed, 3 insertions(+), 4 deletions(-)
> > 
> > I'll let whoever wants to merge this decide whether to take v1 with
> > the updated hashes or v2 using the Git repository.
> > 
> > diff --git a/recipes-core/jdepend/jdepend_2.9.1.bb b/recipes-
> > core/jdepend/
> > jdepend_2.9.1.bb
> > index 5f09a8b..dfbf493 100644
> > --- a/recipes-core/jdepend/jdepend_2.9.1.bb
> > +++ b/recipes-core/jdepend/jdepend_2.9.1.bb
> > @@ -6,7 +6,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=
> > f5777d32a7709d558c2877d4a6616230"
> > 
> >  HOMEPAGE = "https://github.com/clarkware/jdepend"
> > 
> > -SRC_URI = "https://github.com/clarkware/jdepend/archive/${PV}.zip;
> > downloadfilename=${BP}.zip"
> > +SRC_URI = "git://github.com/clarkware/jdepend"
> > +SRCREV = "57980590313a5dbde236a3eb2c8958e9e53e6a10"
> > +S = "${WORKDIR}/git"
> > 
> >  inherit java-library
> > 
> > @@ -18,7 +20,4 @@ do_compile() {
> >    fastjar cf ${JARFILENAME} -C build .
> >  }
> > 
> > -SRC_URI[md5sum] = "9b91efe1d770e023893f89f4dde8434e"
> > -SRC_URI[sha256sum] = "536b5082d64e4f4dddd514ce30178f
> > 36c7a31b34d969275f278f72e522e7f7c9"
> > -
> >  BBCLASSEXTEND = "native"
> > --
> > 2.11.0
> > 
> > 
> > --
> > _______________________________________________
> > Openembedded-devel mailing list
> > Openembedded-devel@lists.openembedded.org
> > http://lists.openembedded.org/mailman/listinfo/openembedded-devel
> >