Skip to contentSkip to conversation

core: look for package's hashes in versioned sub-directory

PATCH New Yann E. MORIN 3 participants 16 messages Oct 7, 2018 – Oct 13, 2018 Kbuild

lore
Share & tools
lore

Yann E. MORIN

author
#0 lore raw

cover core: look for package's hashes in versioned sub-directory

Hello All!

When we support two (or more) versions for a package (e.g. qt5base), and those versions have different licensing terms but stored in the same file (e.g. 'LICENSE'), we can't store the hashes for the license files in the same .hash file, as all hashes for a file must match, which would obviously not be the case here.

So, we've already started moving those hash files in a sub-directory named after the version, but only for the license files hashes; the hashes for the downloaded files were left in the main .hash file.

This is not so consistent; hashes for a version should be in the same file.

This series allows that, by introducing a per-package variable that contains the path to the license file, so that it can be used both by the download and legal-info infras.

To be noted: for packages that already have a per-version hash file for their licensing terms, but a common hash file for their downloads, we have to carefully switch them over to a per-version hash file only, while still ensuring that both download and license hashes are still checked for at every point in the series.

If we were to move the download hashes before the download infra learns to look into subdirs, the download hashes woudl not be checked for. Conversely, if the download infra were to learn to look into subdirs before the download hashes are moved to the per-version hash file, then the download hashes would not be checked for either.

So we have to duplicate the download hashes, then teach the download infra to look into per-version subdir, and finally remove the common hash file.

Fortunately, only a few qt5 packages currently have both a per-version hash file and a common hash file.

There are a few more packages for which we offer a version choice (not a free-form), like gcc, gdb et al. For those, the licensing terms do not change across those versions, so we do not need to have per-version hash files. Ditto for those packages for which we offer a free-form version option, like linux, uboot, barebox...

Regards,
Yann E. MORIN.

The following changes since commit d522be6e0bf2631e3c68298e810d5cb2eb7ebefe

docs/website: update for 2018.08.1 (2018-10-07 11:46:29 +0200)

are available in the git repository at:

git://git.buildroot.org/~ymorin/git/buildroot.git

for you to fetch changes up to e2b0c44702c93f2610f58c09fd8e1aeb41d594aa

docs/manual: document location of hash files for multi-versions packages (2018-10-07 12:49:58 +0200)

----------------------------------------------------------------
Yann E. MORIN (6):
core: add a variable that points to the package's hash file
legal-info: use the per-package variable to get the hash file package/qt5: prepare for per-version hash files core/download: do not hard-code the path to hte package hash file package/qt5: drop unversioned hash files
docs/manual: document location of hash files for multi-versions packages

 Makefile                                                 |  2 +-
 docs/manual/adding-packages-directory.txt                |  7 +++++++
 package/pkg-download.mk                                  |  2 +-
 package/pkg-generic.mk                                   |  8 +++++++-
 package/pkg-utils.mk                                     |  8 ++------
 package/qt5/qt5base/{ => 5.11.2}/qt5base.hash            |  3 ---
 package/qt5/qt5base/5.6.3/qt5base.hash                   |  3 +++
 package/qt5/qt5base/qt5base.hash                         | 16 ++--------------
 .../{ => 5.11.2}/qt5quickcontrols2.hash                  |  3 ---
 .../qt5/qt5quickcontrols2/5.6.3/qt5quickcontrols2.hash   |  3 +++
 package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash     | 12 ++----------
 .../qt5/qt5virtualkeyboard/2.0/qt5virtualkeyboard.hash   |  3 +++
 .../{ => 5.11.2}/qt5virtualkeyboard.hash                 |  3 ---
 package/qt5/qt5virtualkeyboard/qt5virtualkeyboard.hash   | 14 ++------------
 14 files changed, 33 insertions(+), 54 deletions(-)
 copy package/qt5/qt5base/{ => 5.11.2}/qt5base.hash (79%)
 copy package/qt5/qt5quickcontrols2/{ => 5.11.2}/qt5quickcontrols2.hash (68%)
 copy package/qt5/qt5virtualkeyboard/{ => 5.11.2}/qt5virtualkeyboard.hash (77%)
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
author
#1 lore raw

PATCH 1/6 core: add a variable that points to the package's hash file

When a package has a version selection (e.g. Qt5), the licensing terms may be different across versions, but lie in similarly named files (e.g. 'LICENSE').

However, when we check a file, all the hashes for it must match. So, we can't have the hashes for two different content of the same file. We overcame that limitation in the legal-license-file macro, which checks whether a package has a .hash file in a versioned subdir.

For consistency, we would like to also store the source hashes in that per-version subdir.

Rather than reconstruct the path to the hash file everywhere we need it, add a variable that points to it.

Existing users will be converted over in followup patches.

Note: the check for a missing hash file is done in the check-hash helper script, so this variable must always yield a filename, even of a missing file, thus we do not use $(wildcard...) to resolve the hash file path; we use $(wildcard...) only to check if the versioned .hash file exists.

Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 package/pkg-generic.mk | 6 ++++++
 1 file changed, 6 insertions(+)
package/pkg-generic.mk +6 -0
index 91b61c6de0..b3d9ffe932 100644
@@ -434,6 +434,12 @@ else
 endif
 $(2)_VERSION := $$(call sanitize,$$($(2)_DL_VERSION))
 
+$(2)_HASH_FILE = \
+	$$(strip \
+		$$(if $$(wildcard $$($(2)_PKGDIR)/$$($(2)_VERSION)/$$($(2)_RAWNAME).hash),\
+			$$($(2)_PKGDIR)/$$($(2)_VERSION)/$$($(2)_RAWNAME).hash,\
+			$$($(2)_PKGDIR)/$$($(2)_RAWNAME).hash))
+
 ifdef $(3)_OVERRIDE_SRCDIR
   $(2)_OVERRIDE_SRCDIR ?= $$($(3)_OVERRIDE_SRCDIR)
 endif
Signature · 1 line
2.14.1
#2 lore raw

PATCH 1/6 core: add a variable that points to the package's hash file

Hi,

Quoted 22 lines · Yann E. MORIN

When a package has a version selection (e.g. Qt5), the licensing terms may be different across versions, but lie in similarly named files (e.g. 'LICENSE').

However, when we check a file, all the hashes for it must match. So, we can't have the hashes for two different content of the same file. We overcame that limitation in the legal-license-file macro, which checks whether a package has a .hash file in a versioned subdir.

For consistency, we would like to also store the source hashes in that per-version subdir.

Rather than reconstruct the path to the hash file everywhere we need it, add a variable that points to it.

Existing users will be converted over in followup patches.

Note: the check for a missing hash file is done in the check-hash helper script, so this variable must always yield a filename, even of a missing file, thus we do not use $(wildcard...) to resolve the hash file path; we use $(wildcard...) only to check if the versioned .hash file exists.

Quoted 5 lines
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
Reviewed-by Luca Ceresoli <[email protected]>
Signature · 1 line
Luca
author
#3 lore raw

PATCH 2/6 legal-info: use the per-package variable to get the hash file

In reply to Yann E. MORIN
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 Makefile               | 2 +-
 package/pkg-generic.mk | 2 +-
 package/pkg-utils.mk   | 8 ++------
 3 files changed, 4 insertions(+), 8 deletions(-)
Makefile +1 -1
index 82dd76ea76..4948b7f5b1 100644
@@ -792,7 +792,7 @@ legal-info-clean:
 .PHONY: legal-info-prepare
 legal-info-prepare: $(LEGAL_INFO_DIR)
 	@$(call MESSAGE,"Buildroot $(BR2_VERSION_FULL) Collecting legal info")
-	@$(call legal-license-file,buildroot,buildroot,support/legal-info,COPYING,COPYING,HOST)
+	@$(call legal-license-file,buildroot,buildroot,support/legal-info/buildroot.hash,COPYING,COPYING,HOST)
 	@$(call legal-manifest,PACKAGE,VERSION,LICENSE,LICENSE FILES,SOURCE ARCHIVE,SOURCE SITE,TARGET)
 	@$(call legal-manifest,PACKAGE,VERSION,LICENSE,LICENSE FILES,SOURCE ARCHIVE,SOURCE SITE,HOST)
 	@$(call legal-manifest,buildroot,$(BR2_VERSION_FULL),GPL-2.0+,COPYING,not saved,not saved,HOST)
package/pkg-generic.mk +1 -1
index b3d9ffe932..5bd131481f 100644
@@ -912,7 +912,7 @@ ifneq ($$(call qstrip,$$($(2)_SOURCE)),)
 ifeq ($$(call qstrip,$$($(2)_LICENSE_FILES)),)
 	$(Q)$$(call legal-warning-pkg,$$($(2)_BASENAME_RAW),cannot save license ($(2)_LICENSE_FILES not defined))
 else
-	$(Q)$$(foreach F,$$($(2)_LICENSE_FILES),$$(call legal-license-file,$$($(2)_RAWNAME),$$($(2)_BASENAME_RAW),$$($(2)_PKGDIR),$$(F),$$($(2)_DIR)/$$(F),$$(call UPPERCASE,$(4)))$$(sep))
+	$(Q)$$(foreach F,$$($(2)_LICENSE_FILES),$$(call legal-license-file,$$($(2)_RAWNAME),$$($(2)_BASENAME_RAW),$$($(2)_HASH_FILE),$$(F),$$($(2)_DIR)/$$(F),$$(call UPPERCASE,$(4)))$$(sep))
 endif # license files
 
 ifeq ($$($(2)_SITE_METHOD),local)
package/pkg-utils.mk +2 -6
index c3acc22b17..be287dc817 100644
@@ -83,14 +83,10 @@ define legal-manifest # pkg, version, license, license-files, source, url, {HOST
 	echo '"$(1)","$(2)","$(3)","$(4)","$(5)","$(6)"' >>$(LEGAL_MANIFEST_CSV_$(7))
 endef
 
-define legal-license-file # pkgname, pkgname-pkgver, pkgdir, filename, file-fullpath, {HOST|TARGET}
+define legal-license-file # pkgname, pkgname-pkgver, pkg-hashfile, filename, file-fullpath, {HOST|TARGET}
 	mkdir -p $(LICENSE_FILES_DIR_$(6))/$(2)/$(dir $(4)) && \
 	{ \
-		if [ -f $(3)/$($(PKG)_VERSION)/$(1).hash ]; then \
-			support/download/check-hash $(3)/$($(PKG)_VERSION)/$(1).hash $(5) $(4); \
-		else \
-			support/download/check-hash $(3)/$(1).hash $(5) $(4); \
-		fi; \
+		support/download/check-hash $(3) $(5) $(4); \
 		case $${?} in (0|3) ;; (*) exit 1;; esac; \
 	} && \
 	cp $(5) $(LICENSE_FILES_DIR_$(6))/$(2)/$(4)
Signature · 1 line
2.14.1
author
#5 lore raw

PATCH 3/6 package/qt5: prepare for per-version hash files

In reply to Yann E. MORIN

The Qt5 packages may have different licensing terms between the two versions we support, and in some cases, those different terms are expressed in similarly named files, like files named plain 'LICENSE' for example. This is problematic, because, in a .hash file, we can't store two different hashes for the same file.

We've started to handle this case by moving the licenses hashes to the per-version sub directories.

However, the hashes for the downloads are still stored inside the non- versioned hash file of the package, which is not totally coherent: if we have a per-version hash file, it should list all the hases for that version, downloads included, and there should be no unversioned hash file.

In preparation for this, we duplicate the downloads hashes from the main hash files, and into the versioned ones. Once the download infra learns to look for those hashes in these per-version subdirs, we'll remove the unversioned hash files.

Note that there are a few other packages for which we support differents versions (uboot, binutils, gcc, gdb, lua, xserver_xorg-server), but none of those have different licensing terms due to the version. Qt5 is alone is this case.

Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Ga?l Portay <[email protected]>
Cc Peter Seiderer <[email protected]>
Cc Julien Corjon <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 package/qt5/qt5base/5.11.2/qt5base.hash                       | 11 +++++++++++
 package/qt5/qt5base/5.6.3/qt5base.hash                        |  3 +++
 package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash   |  7 +++++++
 package/qt5/qt5quickcontrols2/5.6.3/qt5quickcontrols2.hash    |  3 +++
 package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash          |  5 -----
 package/qt5/qt5virtualkeyboard/2.0/qt5virtualkeyboard.hash    |  3 +++
 package/qt5/qt5virtualkeyboard/5.11.2/qt5virtualkeyboard.hash |  9 +++++++++
 7 files changed, 36 insertions(+), 5 deletions(-)
 create mode 100644 package/qt5/qt5base/5.11.2/qt5base.hash
 create mode 100644 package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash
 create mode 100644 package/qt5/qt5virtualkeyboard/5.11.2/qt5virtualkeyboard.hash
package/qt5/qt5base/5.11.2/qt5base.hash new file +11 -0
new file mode 100644
index 0000000000..1c11adba2d
@@ -0,0 +1,11 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtbase-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 6381e7c3468d5a1dcfe3683b29eeced192faa0f8a32434fec071a59b8bcd0107 qtbase-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 LICENSE.GPL2
+sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 LICENSE.GPL3
+sha256 0dbe024961f6ab5c52689cbd036c977975d0d0f6a67ff97762d96cb819dd5652 LICENSE.GPL3-EXCEPT
+sha256 88ec689407cf2df9b2eb5c45952564d51ce73c129a3bdffb15c0d2d161ad7558 LICENSE.LGPLv3
+sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
+sha256 1f4fa3d202198f5d836993748eac9d91157e2cec7fb8426f56000a02a677cdc5 header.BSD
+sha256 2a886915de4f296cdae5ed67064f86dba01d0c55286d86e8487f2a5caaf40216 src/3rdparty/harfbuzz-ng/COPYING
package/qt5/qt5base/5.6.3/qt5base.hash +3 -0
index f113f82c73..2dae2e8bf0 100644
@@ -1,3 +1,6 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtbase-opensource-src-5.6.3.tar.xz.mirrorlist
+sha256 fef48529a6fc2617a30d75d952cb327c6be341fd104154993922184b3b3b4da1 qtbase-opensource-src-5.6.3.tar.xz
+
 # Hashes for license files:
 sha256 245248009fd0af1725d183248380e476c1283383909358a13686606352bf2a17 LICENSE.GPLv3
 sha256 66f6bb53f6d985a4d651bf1ecfe8bbcbe32b0f744708d588f047580ee85d8ec8 LICENSE.LGPLv21
package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash new file +7 -0
new file mode 100644
index 0000000000..bdf844eb91
@@ -0,0 +1,7 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
+sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
+sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
package/qt5/qt5quickcontrols2/5.6.3/qt5quickcontrols2.hash +3 -0
index 6f5bf29400..01fe5dcd61 100644
@@ -1,3 +1,6 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtquickcontrols2-opensource-src-5.6.3.tar.xz.mirrorlist
+sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickcontrols2-opensource-src-5.6.3.tar.xz
+
 # Hashes for license files:
 sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
 sha256 245248009fd0af1725d183248380e476c1283383909358a13686606352bf2a17 LICENSE.GPLv3
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -5
index 1ebed34166..eb97371337 100644
@@ -3,8 +3,3 @@ sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc
 
 # Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
 sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
-
-# Hashes for license files:
-sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
-sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
-sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
package/qt5/qt5virtualkeyboard/2.0/qt5virtualkeyboard.hash +3 -0
index 266fc3b695..0cc4f9c82e 100644
@@ -1,3 +1,6 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtvirtualkeyboard-opensource-src-2.0.tar.xz.mirrorlist
+sha256 1d543a851e83fc3de40f48c2935f70278e842589b9a235c2b22f41733e561aec qtvirtualkeyboard-opensource-src-2.0.tar.xz
+
 # Hashes for license files:
 sha256 6148d2793ca4e62ba3935a27bd3e46971a5d7c871dbe8f2687a867bd2c2589fb src/virtualkeyboard/3rdparty/lipi-toolkit/license.txt
 sha256 05cc719deafd0ab083b03296bb2911de10d116953b626a7629b9ca59938038b1 src/virtualkeyboard/3rdparty/openwnn/NOTICE
package/qt5/qt5virtualkeyboard/5.11.2/qt5virtualkeyboard.hash new file +9 -0
new file mode 100644
index 0000000000..c065a9e807
@@ -0,0 +1,9 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtvirtualkeyboard-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 2709500071e7e98ca6f6eecef0f5c80d19ae22aba562293352debd516633b197 qtvirtualkeyboard-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 LICENSE.GPL3
+sha256 7a45a9769d19545480a241230e6ea520b5156fac00930dcd69b6886749743d10 src/virtualkeyboard/3rdparty/lipi-toolkit/MIT_LICENSE.txt
+sha256 05cc719deafd0ab083b03296bb2911de10d116953b626a7629b9ca59938038b1 src/virtualkeyboard/3rdparty/openwnn/NOTICE
+sha256 b5830d96fb5a7e7e7ebcc295f352846b4b998e78fdc8f9aa68e134d2e4b39986 src/virtualkeyboard/3rdparty/pinyin/NOTICE
+sha256 9400a6128693d2f25653698e695f554660c71efccc8c21af28bf143e35199db6 src/virtualkeyboard/3rdparty/tcime/COPYING
Signature · 1 line
2.14.1
#6 lore raw

PATCH 3/6 package/qt5: prepare for per-version hash files

Hi,

Quoted 103 lines · Yann E. MORIN

The Qt5 packages may have different licensing terms between the two versions we support, and in some cases, those different terms are expressed in similarly named files, like files named plain 'LICENSE' for example. This is problematic, because, in a .hash file, we can't store two different hashes for the same file.

We've started to handle this case by moving the licenses hashes to the per-version sub directories.

However, the hashes for the downloads are still stored inside the non- versioned hash file of the package, which is not totally coherent: if we have a per-version hash file, it should list all the hases for that version, downloads included, and there should be no unversioned hash file.

In preparation for this, we duplicate the downloads hashes from the main hash files, and into the versioned ones. Once the download infra learns to look for those hashes in these per-version subdirs, we'll remove the unversioned hash files.

Note that there are a few other packages for which we support differents versions (uboot, binutils, gcc, gdb, lua, xserver_xorg-server), but none of those have different licensing terms due to the version. Qt5 is alone is this case.

Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Ga?l Portay <[email protected]>
Cc Peter Seiderer <[email protected]>
Cc Julien Corjon <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 package/qt5/qt5base/5.11.2/qt5base.hash                       | 11 +++++++++++
 package/qt5/qt5base/5.6.3/qt5base.hash                        |  3 +++
 package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash   |  7 +++++++
 package/qt5/qt5quickcontrols2/5.6.3/qt5quickcontrols2.hash    |  3 +++
 package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash          |  5 -----
 package/qt5/qt5virtualkeyboard/2.0/qt5virtualkeyboard.hash    |  3 +++
 package/qt5/qt5virtualkeyboard/5.11.2/qt5virtualkeyboard.hash |  9 +++++++++
 7 files changed, 36 insertions(+), 5 deletions(-)
 create mode 100644 package/qt5/qt5base/5.11.2/qt5base.hash
 create mode 100644 package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash
 create mode 100644 package/qt5/qt5virtualkeyboard/5.11.2/qt5virtualkeyboard.hash
package/qt5/qt5base/5.11.2/qt5base.hash new file +11 -0
new file mode 100644
index 0000000000..1c11adba2d
@@ -0,0 +1,11 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtbase-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 6381e7c3468d5a1dcfe3683b29eeced192faa0f8a32434fec071a59b8bcd0107 qtbase-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 LICENSE.GPL2
+sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 LICENSE.GPL3
+sha256 0dbe024961f6ab5c52689cbd036c977975d0d0f6a67ff97762d96cb819dd5652 LICENSE.GPL3-EXCEPT
+sha256 88ec689407cf2df9b2eb5c45952564d51ce73c129a3bdffb15c0d2d161ad7558 LICENSE.LGPLv3
+sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
+sha256 1f4fa3d202198f5d836993748eac9d91157e2cec7fb8426f56000a02a677cdc5 header.BSD
+sha256 2a886915de4f296cdae5ed67064f86dba01d0c55286d86e8487f2a5caaf40216 src/3rdparty/harfbuzz-ng/COPYING
package/qt5/qt5base/5.6.3/qt5base.hash +3 -0
index f113f82c73..2dae2e8bf0 100644
@@ -1,3 +1,6 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtbase-opensource-src-5.6.3.tar.xz.mirrorlist
+sha256 fef48529a6fc2617a30d75d952cb327c6be341fd104154993922184b3b3b4da1 qtbase-opensource-src-5.6.3.tar.xz
+
 # Hashes for license files:
 sha256 245248009fd0af1725d183248380e476c1283383909358a13686606352bf2a17 LICENSE.GPLv3
 sha256 66f6bb53f6d985a4d651bf1ecfe8bbcbe32b0f744708d588f047580ee85d8ec8 LICENSE.LGPLv21
package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash new file +7 -0
new file mode 100644
index 0000000000..bdf844eb91
@@ -0,0 +1,7 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
+sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
+sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
package/qt5/qt5quickcontrols2/5.6.3/qt5quickcontrols2.hash +3 -0
index 6f5bf29400..01fe5dcd61 100644
@@ -1,3 +1,6 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtquickcontrols2-opensource-src-5.6.3.tar.xz.mirrorlist
+sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickcontrols2-opensource-src-5.6.3.tar.xz
+
 # Hashes for license files:
 sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
 sha256 245248009fd0af1725d183248380e476c1283383909358a13686606352bf2a17 LICENSE.GPLv3
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -0
index 1ebed34166..eb97371337 100644

package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc · line 10

Quoted 8 lines
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -5
@@ -3,8 +3,3 @@ sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc
 
 # Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
 sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
-
-# Hashes for license files:
-sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
-sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
-sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL

Shouldn't this removal happen in patch 5?

Signature · 1 line
Luca
author
#7 lore raw

PATCH 3/6 package/qt5: prepare for per-version hash files

Lucal, All,

On 2018-10-12 09:12 +0200, Luca Ceresoli spake thusly:

Quoted 16 lines · Yann E. MORIN
Quoted 15 lines

The Qt5 packages may have different licensing terms between the two versions we support, and in some cases, those different terms are expressed in similarly named files, like files named plain 'LICENSE' for example. This is problematic, because, in a .hash file, we can't store two different hashes for the same file.

We've started to handle this case by moving the licenses hashes to the per-version sub directories.

However, the hashes for the downloads are still stored inside the non- versioned hash file of the package, which is not totally coherent: if we have a per-version hash file, it should list all the hases for that version, downloads included, and there should be no unversioned hash file.

Quoted 4 lines
Quoted 4 lines

In preparation for this, we duplicate the downloads hashes from the main hash files, and into the versioned ones. Once the download infra learns to look for those hashes in these per-version subdirs, we'll remove the unversioned hash files.

[--SNIP--]

Quoted 5 lines
Quoted 5 lines
package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash new file +0 -0
new file mode 100644
index 0000000000..bdf844eb91
Quoted 8 lines

package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash line 7

Quoted 8 lines
package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash new file +7 -0
@@ -0,0 +1,7 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
+sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
+sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL

[--SNIP--]

Quoted 6 lines
Quoted 6 lines
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -0
index 1ebed34166..eb97371337 100644
@@ -3,8 +3,3 @@ sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc
Quoted 9 lines

package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc · line 10

Quoted 7 lines
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -5
 # Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
 sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
-
-# Hashes for license files:
-sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
-sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
-sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL

Shouldn't this removal happen in patch 5?

Notice how we create the .hash file for the 5.11.2 version? This means that the hash-check for license files will be using it rather than the main hash file.

So, the hashes for the license of the 5.11.2 version are no longer usefull in the main hash file, ergo they get removed.

Thanks for the review of the series! :-)

Regards,
Yann E. MORIN.

Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
#8 lore raw

PATCH 3/6 package/qt5: prepare for per-version hash files

Hi,

Quoted 54 lines · Yann E. MORIN

Lucal, All,

On 2018-10-12 09:12 +0200, Luca Ceresoli spake thusly:

Quoted 16 lines · Yann E. MORIN
Quoted 15 lines

The Qt5 packages may have different licensing terms between the two versions we support, and in some cases, those different terms are expressed in similarly named files, like files named plain 'LICENSE' for example. This is problematic, because, in a .hash file, we can't store two different hashes for the same file.

We've started to handle this case by moving the licenses hashes to the per-version sub directories.

However, the hashes for the downloads are still stored inside the non- versioned hash file of the package, which is not totally coherent: if we have a per-version hash file, it should list all the hases for that version, downloads included, and there should be no unversioned hash file.

Quoted 4 lines
Quoted 4 lines

In preparation for this, we duplicate the downloads hashes from the main hash files, and into the versioned ones. Once the download infra learns to look for those hashes in these per-version subdirs, we'll remove the unversioned hash files.

[--SNIP--]

Quoted 5 lines
Quoted 5 lines
package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash new file +0 -0
new file mode 100644
index 0000000000..bdf844eb91
Quoted 8 lines

package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash line 7

Quoted 8 lines
package/qt5/qt5quickcontrols2/5.11.2/qt5quickcontrols2.hash new file +7 -0
@@ -0,0 +1,7 @@
+# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
+sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
+
+# Hashes for license files:
+sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
+sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
+sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL

[--SNIP--]

Quoted 6 lines
Quoted 6 lines
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -0
index 1ebed34166..eb97371337 100644
@@ -3,8 +3,3 @@ sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc
Quoted 9 lines

package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc · line 10

Quoted 7 lines
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -5
 # Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
 sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
-
-# Hashes for license files:
-sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
-sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
-sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL

Shouldn't this removal happen in patch 5?

Quoted 6 lines

Notice how we create the .hash file for the 5.11.2 version? This means that the hash-check for license files will be using it rather than the main hash file.

So, the hashes for the license of the 5.11.2 version are no longer usefull in the main hash file, ergo they get removed.

So this is a bit different from what you do to qt5base and qt5virtualkeyboard. For those you leave the license hashes both in the versioned files and the unversioned files.

However this difference has no practical effect since after patch 3 there are versioned hashes for all versions, thus the unversioned file is ignored. Patch 5 will trim all the unused lines anyway, so I'm OK if this is committed as-is.

Bye,

Signature · 1 line
Luca
author
#9 lore raw

PATCH 3/6 package/qt5: prepare for per-version hash files

Luca, All,

On 2018-10-13 00:07 +0200, Luca Ceresoli spake thusly:

Quoted 3 lines · Yann E. MORIN
Quoted 2 lines

On 2018-10-12 09:12 +0200, Luca Ceresoli spake thusly:

Quoted 1 line · Yann E. MORIN

[--SNIP--]

Quoted 11 lines
Quoted 11 lines
Quoted 6 lines

package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickc · line 10

Quoted 4 lines
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +0 -4
-# Hashes for license files:
-sha256 d2cfc059acb4abd8e513cd0a73cd8489f34cbafa7bc34d5d31fb3210821cf8ca LICENSE.GPLv3
-sha256 9e63a04ce021b8bf811b30881fa51c8c3db88afeead942cd59322f2fb69c75bc LICENSE.LGPLv3
-sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL

Shouldn't this removal happen in patch 5?

Notice how we create the .hash file for the 5.11.2 version? This means that the hash-check for license files will be using it rather than the main hash file.

Quoted 6 lines
Quoted 2 lines

So, the hashes for the license of the 5.11.2 version are no longer usefull in the main hash file, ergo they get removed.

So this is a bit different from what you do to qt5base and qt5virtualkeyboard. For those you leave the license hashes both in the versioned files and the unversioned files.

Ah, right, I forgot to do it for those, indeed. I've fixed it.

Quoted 4 lines

However this difference has no practical effect since after patch 3 there are versioned hashes for all versions, thus the unversioned file is ignored. Patch 5 will trim all the unused lines anyway, so I'm OK if this is committed as-is.

In fact, I'd prefer to respin with:

- a patch that does things consistently, i.e. that either removes the license for the two paclages, or for none of them, not tsomething in-between ;

- a better commit log that adds the explanations you requested.

Thanks! :-)

Regards,
Yann E. MORIN.

Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
author
#10 lore raw

PATCH 4/6 core/download: do not hard-code the path to hte package hash file

In reply to Yann E. MORIN

Now that packges may have hashes for their downloaded files in a versioned subdir or in the unversioned hash file, we can no longer hard-code the path to the package hash file anymore.

Instead, we now make use of the per-package variable, that points to the package hash file.

Note: of the packages for which we offer a version choice, almost none, but some of the qt5 ones, have a per-version hash file, so we still use the unversioned hash file for them. As for the few qt5 packages that do have a per-version hash file for their licensing terms, they've already been updated to duplicate their download hashes in both the unversioned and per-version hash files. So, one way or the other, no hash check would go missing with this change.

Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 package/pkg-download.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
package/pkg-download.mk +1 -1
index bf93b9a08e..73ea2a69f8 100644
@@ -97,7 +97,7 @@ define DOWNLOAD
 		-d '$($(PKG)_DL_DIR)' \
 		-D '$(DL_DIR)' \
 		-f '$(notdir $(1))' \
-		-H '$(PKGDIR)/$($(PKG)_RAWNAME).hash' \
+		-H '$($(PKG)_HASH_FILE)' \
 		-n '$($(PKG)_BASENAME_RAW)' \
 		-N '$($(PKG)_RAWNAME)' \
 		-o '$($(PKG)_DL_DIR)/$(notdir $(1))' \
Signature · 1 line
2.14.1
#11 lore raw

PATCH 4/6 core/download: do not hard-code the path to hte package hash file

Hi,

Quoted 15 lines · Yann E. MORIN

Now that packges may have hashes for their downloaded files in a versioned subdir or in the unversioned hash file, we can no longer hard-code the path to the package hash file anymore.

Instead, we now make use of the per-package variable, that points to the package hash file.

Note: of the packages for which we offer a version choice, almost none, but some of the qt5 ones, have a per-version hash file, so we still use the unversioned hash file for them. As for the few qt5 packages that do have a per-version hash file for their licensing terms, they've already been updated to duplicate their download hashes in both the unversioned and per-version hash files. So, one way or the other, no hash check would go missing with this change.

Quoted 5 lines
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>

Minor nit: "hte" -> "the" in the subject line.

Anyway,

Reviewed-by Luca Ceresoli <[email protected]>
Signature · 1 line
Luca
author
#12 lore raw

PATCH 5/6 package/qt5: drop unversioned hash files

In reply to Yann E. MORIN

The download infra now knows to look for per-version hash files, so we can now drop the unversioned hash files.

Instead of removing them, add a comment that redirect the developper to update the per-version hash files instead (so they do not re-add a unversioned hash file in the future).

Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Ga?l Portay <[email protected]>
Cc Peter Seiderer <[email protected]>
Cc Julien Corjon <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 package/qt5/qt5base/qt5base.hash                       | 16 ++--------------
 package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash   |  7 ++-----
 package/qt5/qt5virtualkeyboard/qt5virtualkeyboard.hash | 14 ++------------
 3 files changed, 6 insertions(+), 31 deletions(-)
package/qt5/qt5base/qt5base.hash +2 -14
index daac4e06a3..5316f03b10 100644
@@ -1,14 +1,2 @@
-# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtbase-opensource-src-5.6.3.tar.xz.mirrorlist
-sha256 fef48529a6fc2617a30d75d952cb327c6be341fd104154993922184b3b3b4da1 qtbase-opensource-src-5.6.3.tar.xz
-
-# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtbase-everywhere-src-5.11.2.tar.xz.mirrorlist
-sha256 6381e7c3468d5a1dcfe3683b29eeced192faa0f8a32434fec071a59b8bcd0107 qtbase-everywhere-src-5.11.2.tar.xz
-
-# Hashes for license files:
-sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 LICENSE.GPL2
-sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 LICENSE.GPL3
-sha256 0dbe024961f6ab5c52689cbd036c977975d0d0f6a67ff97762d96cb819dd5652 LICENSE.GPL3-EXCEPT
-sha256 88ec689407cf2df9b2eb5c45952564d51ce73c129a3bdffb15c0d2d161ad7558 LICENSE.LGPLv3
-sha256 ed8742a95cb9db653a09b050e27ccff5e67ba69c14aa2c3137f2a4e1892f6c0d LICENSE.FDL
-sha256 1f4fa3d202198f5d836993748eac9d91157e2cec7fb8426f56000a02a677cdc5 header.BSD
-sha256 2a886915de4f296cdae5ed67064f86dba01d0c55286d86e8487f2a5caaf40216 src/3rdparty/harfbuzz-ng/COPYING
+# This hash file is not used; instead, update the
+# hash files in the per-version sub-directories.
package/qt5/qt5quickcontrols2/qt5quickcontrols2.hash +2 -5
index eb97371337..5316f03b10 100644
@@ -1,5 +1,2 @@
-# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtquickcontrols2-opensource-src-5.6.3.tar.xz.mirrorlist
-sha256 ec5078470abe2da888c2be5d1749b5961ef5132487c180ce4d4aa19ea7ff81cb qtquickcontrols2-opensource-src-5.6.3.tar.xz
-
-# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtquickcontrols2-everywhere-src-5.11.2.tar.xz.mirrorlist
-sha256 aa0549f9a4135f9d600b57f53347ebf344e60d21f90c6d844109755da12dcb84 qtquickcontrols2-everywhere-src-5.11.2.tar.xz
+# This hash file is not used; instead, update the
+# hash files in the per-version sub-directories.
package/qt5/qt5virtualkeyboard/qt5virtualkeyboard.hash +2 -12
index d4b7e58e38..5316f03b10 100644
@@ -1,12 +1,2 @@
-# Hash from: https://download.qt.io/official_releases/qt/5.6/5.6.3/submodules/qtvirtualkeyboard-opensource-src-2.0.tar.xz.mirrorlist
-sha256 1d543a851e83fc3de40f48c2935f70278e842589b9a235c2b22f41733e561aec qtvirtualkeyboard-opensource-src-2.0.tar.xz
-
-# Hash from: https://download.qt.io/official_releases/qt/5.11/5.11.2/submodules/qtvirtualkeyboard-everywhere-src-5.11.2.tar.xz.mirrorlist
-sha256 2709500071e7e98ca6f6eecef0f5c80d19ae22aba562293352debd516633b197 qtvirtualkeyboard-everywhere-src-5.11.2.tar.xz
-
-# Hashes for license files:
-sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 LICENSE.GPL3
-sha256 7a45a9769d19545480a241230e6ea520b5156fac00930dcd69b6886749743d10 src/virtualkeyboard/3rdparty/lipi-toolkit/MIT_LICENSE.txt
-sha256 05cc719deafd0ab083b03296bb2911de10d116953b626a7629b9ca59938038b1 src/virtualkeyboard/3rdparty/openwnn/NOTICE
-sha256 b5830d96fb5a7e7e7ebcc295f352846b4b998e78fdc8f9aa68e134d2e4b39986 src/virtualkeyboard/3rdparty/pinyin/NOTICE
-sha256 9400a6128693d2f25653698e695f554660c71efccc8c21af28bf143e35199db6 src/virtualkeyboard/3rdparty/tcime/COPYING
+# This hash file is not used; instead, update the
+# hash files in the per-version sub-directories.
Signature · 1 line
2.14.1
author
#13 lore raw

PATCH 6/6 docs/manual: document location of hash files for multi-versions packages

In reply to Yann E. MORIN
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Thomas De Schampheleire <[email protected]>
Cc Thomas Petazzoni <[email protected]>
Cc Arnout Vandecappelle <[email protected]>
Cc Luca Ceresoli <[email protected]>
Cc Baruch Siach <[email protected]>
---
 docs/manual/adding-packages-directory.txt | 7 +++++++
 1 file changed, 7 insertions(+)
docs/manual/adding-packages-directory.txt +7 -0
index f5e1e313d5..761605eda9 100644
@@ -444,6 +444,13 @@ contains the hashes of the downloaded files for the +libfoo+
 package. The only reason for not adding a +.hash+ file is when hash
 checking is not possible due to how the package is downloaded.
 
+When a package has a version selection choice, then the hash file may be
+stored in a subdirectory named after the version, e.g.
++package/libfoo/1.2.3/libfoo.hash+. This is especially important if the
+different versions have different licensing terms, but they are stored
+in the same file. Otherwise, the hash file should stay in the package's
+directory.
+
 The hashes stored in that file are used to validate the integrity of the
 downloaded files and of the license files.
Signature · 1 line
2.14.1
#15 lore raw

cover core: look for package's hashes in versioned sub-directory

In reply to Yann E. MORIN

Hello,

Quoted 7 lines · Yann E. MORIN

Yann E. MORIN (6):
core: add a variable that points to the package's hash file
legal-info: use the per-package variable to get the hash file package/qt5: prepare for per-version hash files core/download: do not hard-code the path to hte package hash file package/qt5: drop unversioned hash files
docs/manual: document location of hash files for multi-versions packages

This looks good to me. When applying, we will have to adjust the glibc package as well, which now uses per-version hash files as well, but no need to resend for that.

If nobody complains by tomorrow, I'll apply this patch series.

Best regards,

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com