staging/chunkeey/scripts/download.pl, branch v19.07.5

download.pl: properly cleanup intermediate .hash file

2020-12-05T19:50:19Z

It seems like after a build the /dl dir seems to now contain a .hash file for each source file due to inproper cleanup so fix it by removing those intermediate files before leaving the download action. Fixes: 4e19cbc55335 ("download: handle possibly invalid local tarballs") Reported-by: Hannu Nyman Signed-off-by: Petr Štetiar (cherry picked from commit 52a5d0d27f2557db99fc5435fbd7783b649cb9b2)

download: handle possibly invalid local tarballs

2020-12-05T19:50:19Z

Currently it's assumed, that already downloaded tarballs are always fine, so no checksum checking is performed and the tarball is used even if it might be corrupted. From now on, we're going to always check the downloaded tarballs before considering them valid. Steps to reproduce: 1. Remove cached tarball rm dl/libubox-2020-08-06-9e52171d.tar.xz 2. Download valid tarball again make package/libubox/download 3. Invalidate the tarball sed -i 's/PKG_MIRROR_HASH:=../PKG_MIRROR_HASH:=ff/' package/libs/libubox/Makefile 4. Now compile with corrupt tarball source make package/libubox/{clean,compile} Signed-off-by: Petr Štetiar (cherry picked from commit 4e19cbc553350b8146985367ba46514cf50e3393)

scripts: download.pl: retry download using filename

2020-11-20T10:58:01Z

With this commit, the download script will try downloading source files using the filename instead of the url-filename in case the previous download attempt using the url-filename failed. This is required, as the OpenWrt sources mirrors serve files using the filename files might be renamed to after downloading. If the original mirror for a file where url-filename and filename do not match goes down, the download failed prior to this patch. Further improvement can be done by performing this only for the OpenWrt sources mirrors. Signed-off-by: David Bauer (cherry picked from commit d36999389890fb952fc7cc8c0db8e1bbb671af12)

Revert "scripts/download: add sources CDN as first mirror"

2020-08-24T13:56:27Z

This reverts commit c737a9ee6a9c47b6e553ac81bf293b1161e59799. The source CDN has been discontinued in its current form and will take a while to be reestablished. Even then it makes little sense to put a CDN before other CDNs such as kernel.org, apache.org, sourceforge etc. Signed-off-by: Jo-Philipp Wich (cherry picked from commit bf96eb55c82191701030b68810e6f19adbb91eeb)

scripts/download: add sources CDN as first mirror

2020-05-04T22:05:28Z

OpenWrt now has a CDN for sources at sources.cdn.openwrt.org which mirrors sources.openwrt.org. Downloading sources outside Europe or US (mainland) could result in low throughput, extremely slowing down the first compilation of the build system. This patch adds sources.cdn.openwrt.org as the first mirror to offer worldwide fast download speeds by default. If the CDN goes down for whatever reason, the script jumps to the next available mirror and downloads requested files as before (in regional varying speed). Signed-off-by: Paul Spooren Acked-by: Eneas U de Queiroz (cherry picked from commit c737a9ee6a9c47b6e553ac81bf293b1161e59799)

scripts/dowload.pl: add archive.apache.org to apache mirror list

2019-12-22T23:32:01Z

apache mirrors holds only latest releases, to download older releases, one must use archive.apache.org to get them. Signed-off-by: Jiri Kastner (cherry picked from commit dc34c695c4faa46efc6e2367a2ba06a47caa4840)

download.pl: use https://source.openwrt.org

2019-09-04T11:41:25Z

https://sources.lede-openwrt.org now redirects to there https://downloads.openwrt.org/sources returns 404, so remove it here Signed-off-by: Yousong Zhou (cherry picked from commit 0f3667864d5391c2d9ace63ccfc83ab270405cc9)

download.pl: Change OpenWrt mirrors to HTTPS.

2018-05-01T09:12:15Z

These have supported HTTPS for quite a while. I have not seen any obvious breakage. Signed-off-by: Rosen Penev

download.pl: Change SourceForge address to HTTPS.

2018-05-01T09:12:15Z

SourceForge has supported HTTPS for its downloads for a long time now. I have not been able to see any failures resulting from this change. Signed-off-by: Rosen Penev

base-files: allow skipping of hash verification

2017-12-14T08:29:31Z

When calling a download target, hash verification is now completely skipped if we set PKG_HASH=skip. This allows to easily bump package version: $ make package//download PKG_HASH=skip V=s $ make package//check FIXUP=1 V=s This will download the new version of the package, and then automatically update PKG_HASH with the hash of the new version. Of course, it is still the responsibility of the packager to ensure that the new tarball is legitimate, because it is downloaded from a possibly untrusted source. Fixes: b30ba14e ("scripts/download.pl: fail loudly if provided hash is unsupported") Signed-off-by: Baptiste Jonglez Signed-off-by: Jo-Philipp Wich Acked-by: Stijn Tintel Signed-off-by: John Crispin