[Buildroot] [PATCH 2/4] pkg-infra: add possiblity to check downloaded files against known hashes

[Bernd Kuhls]

Am Thu, 05 Nov 2020 22:12:32 +0100 schrieb Yann E. MORIN:

> Bernd, All,
> 
> On 2020-11-05 19:38 +0100, Bernd Kuhls spake thusly:
>> Am Thu, 03 Jul 2014 21:36:21 +0200 schrieb Yann E. MORIN: sqlite.org
>> started to release sha3 hashes for their tarballs:
>> https://www.sqlite.org/download.html
>> 
>> Apparently a sha3sum utility is not available so I tried
>> 
>> openssl dgst -sha3-256 dl/sqlite/sqlite-autoconf-3330000.tar.gz
>> 
>> which shows the hash mentioned upstream:
>> 
>> SHA3-256(dl/sqlite/sqlite-autoconf-3330000.tar.gz)=
>> 6e94e9453cedf8f2023e3923f856741d1e28a2271e9f93d24d95fa48870edaad
>> 
>> Should we add the openssl-way to verify sha3 hashes?
> 
> Unfortunately, this is only present in very recent versions of openssl.
> It was missing in Ubuntu 16.04, while it is present in 18.04 (both still
> supported LTS versions)
> 
> So, I am not really sure how we can move forward...

Hi Yann,

what about host-rhash?
http://patchwork.ozlabs.org/project/buildroot/list/?series=212773

$ output/host/bin/rhash --sha3-256 dl/sqlite/sqlite-
autoconf-3330000.tar.gz 
6e94e9453cedf8f2023e3923f856741d1e28a2271e9f93d24d95fa48870edaad  dl/
sqlite/sqlite-autoconf-3330000.tar.gz

Regards, Bernd