staging/chunkeey/scripts/download.pl, branch state

download.pl: Change OpenWrt mirrors to HTTPS.

2018-05-01T09:12:15Z

These have supported HTTPS for quite a while. I have not seen any obvious breakage. Signed-off-by: Rosen Penev

download.pl: Change SourceForge address to HTTPS.

2018-05-01T09:12:15Z

SourceForge has supported HTTPS for its downloads for a long time now. I have not been able to see any failures resulting from this change. Signed-off-by: Rosen Penev

base-files: allow skipping of hash verification

2017-12-14T08:29:31Z

When calling a download target, hash verification is now completely skipped if we set PKG_HASH=skip. This allows to easily bump package version: $ make package//download PKG_HASH=skip V=s $ make package//check FIXUP=1 V=s This will download the new version of the package, and then automatically update PKG_HASH with the hash of the new version. Of course, it is still the responsibility of the packager to ensure that the new tarball is legitimate, because it is downloaded from a possibly untrusted source. Fixes: b30ba14e ("scripts/download.pl: fail loudly if provided hash is unsupported") Signed-off-by: Baptiste Jonglez Signed-off-by: Jo-Philipp Wich Acked-by: Stijn Tintel Signed-off-by: John Crispin

scripts/download.pl: fail loudly if provided hash is unsupported

2017-09-11T15:13:02Z

Currently, if the provided hash is unsupported (length different from 32 or 64 bytes), we happily download the requested file without any kind of checksum verification. This is quite dangerous and may provide a false sense of security, because a single typo in the hash (e.g. one character deleted by mistake) may skip checksum verification entirely. Instead, fail immediately if we don't support the provided hash. In particular, if an external package repository decides to change the hash algorithm one day, we will now fail loudly instead of skipping checksum verification without complaints. Note: if some users of scripts/download.pl knowingly provide an empty hash because they don't need checksum verification, this change will break them. This does not seem to be the case currently, but if this feature is ever needed, an option should be added to download.pl instead of relying on the hash being empty. Fixes: eaa4eba10a89 ("scripts/download.pl: add SHA-256 support") Signed-off-by: Baptiste Jonglez

scripts/dowload.pl: use glob to expand target dir

2017-08-30T16:12:36Z

If CONFIG_DOWNLOAD_FOLDER is set to for example "~/dl", the download script fails to create the .hash and .dl files with the following errors: Cannot create file ~/dl/dropbear-2017.75.tar.bz2.dl: No such file or directory sh: 1: cannot create ~/dl/dropbear-2017.75.tar.bz2.hash: Directory nonexistent If the tarball already exists in the ~/dl dir, it's properly found and used, so this issue only affects the download.pl script. This patch calls glob() on the target dir parameter, which will expand `~`. Signed-off-by: Zoltan Gyarmati

scripts/download.pl: Adjust URLs

2017-07-21T06:09:45Z

Internet2 isn't considered a trusted issuer meaning that https links to rit.edu will fail. The host mirror.csclub.uwaterloo.ca has a trusted SSL cert and peering is good so it can replace rit.edu without performance issues. Signed-off-by: Daniel Engberg [Jo-Philipp Wich: rewrapped commit message] Signed-off-by: Jo-Philipp Wich

scripts/download.pl: print the command used to download files

2017-05-25T17:01:07Z

Signed-off-by: Felix Fietkau

scripts/download.pl: fix error message on hash mismatch

2017-04-04T10:33:37Z

Signed-off-by: Felix Fietkau

download.pl: fix detecting download errors with curl

2017-01-31T10:24:19Z

Avoid treating error pages as successfully downloaded content Signed-off-by: Felix Fietkau

build: use mkhash to replace various quirky md5sum/openssl calls

2017-01-05T10:09:12Z

Signed-off-by: Felix Fietkau