download: handle possibly invalid local tarballs

Currently it's assumed, that already downloaded tarballs are always
fine, so no checksum checking is performed and the tarball is used even
if it might be corrupted.

From now on, we're going to always check the downloaded tarballs before
considering them valid.

Steps to reproduce:

 1. Remove cached tarball

   rm dl/libubox-2020-08-06-9e52171d.tar.xz

 2. Download valid tarball again

   make package/libubox/download

 3. Invalidate the tarball

   sed -i 's/PKG_MIRROR_HASH:=../PKG_MIRROR_HASH:=ff/' package/libs/libubox/Makefile

 4. Now compile with corrupt tarball source

   make package/libubox/{clean,compile}

Signed-off-by: Petr Štetiar <ynezz@true.cz>

diff --git a/include/host-build.mk b/include/host-build.mk
index 7d84ab0f5fc443dedc103d80928a13a09f0f7199..4ac140518113fae55451a2c2170b2a7b698e7077 100644 (file)
--- a/include/host-build.mk
+++ b/include/host-build.mk
@@ -186,6 +186,8 @@ ifndef DUMP
     clean-build: host-clean-build
   endif
 
+  $(DL_DIR)/$(FILE): FORCE
+
   $(_host_target)host-prepare: $(HOST_STAMP_PREPARED)
   $(_host_target)host-configure: $(HOST_STAMP_CONFIGURED)
   $(_host_target)host-compile: $(HOST_STAMP_BUILT) $(HOST_STAMP_INSTALLED)

diff --git a/include/package.mk b/include/package.mk
index 50bd838180d86640856ced178680d3f425b6ebcc..5eb4460db86ce81d7de16646eb469b1dae2f41cb 100644 (file)
--- a/include/package.mk
+++ b/include/package.mk
@@ -189,6 +189,8 @@ define Build/CoreTargets
   $(call Build/Autoclean)
   $(call DefaultTargets)
 
+  $(DL_DIR)/$(FILE): FORCE
+
   download:
        $(foreach hook,$(Hooks/Download),
                $(call $(hook))$(sep)

diff --git a/scripts/download.pl b/scripts/download.pl
index 351b06a08b2f4b4155a40f9fef759ef8f6404b62..2d87f47f842bc7d2b9ccc70f43f1f504e1c8c798 100755 (executable)
--- a/scripts/download.pl
+++ b/scripts/download.pl
@@ -262,6 +262,24 @@ foreach my $mirror (@ARGV) {
 push @mirrors, 'https://sources.openwrt.org';
 push @mirrors, 'https://mirror2.openwrt.org/sources';
 
+if (-f "$target/$filename") {
+       $hash_cmd and do {
+               if (system("cat '$target/$filename' | $hash_cmd > '$target/$filename.hash'")) {
+                       die "Failed to generate hash for $filename\n";
+               }
+
+               my $sum = `cat "$target/$filename.hash"`;
+               $sum =~ /^(\w+)\s*/ or die "Could not generate file hash\n";
+               $sum = $1;
+
+               exit 0 if $sum eq $file_hash;
+
+               die "Hash of the local file $filename does not match (file: $sum, requested: $file_hash) - deleting download.\n";
+               unlink "$target/$filename";
+               cleanup();
+       };
+}
+
 while (!-f "$target/$filename") {
        my $mirror = shift @mirrors;
        $mirror or die "No more mirrors to try - giving up.\n";