[oe] [meta-oe][PATCH] evtest: Provide updated checksums

[Paul Eggleton]

Hi Drew,

On Wednesday 06 August 2014 13:41:15 Moseley, Drew wrote:
> On Aug 6, 2014, at 9:38 AM, Gary Thomas <gary at mlbassoc.com> wrote:
> > On 2014-08-06 07:21, Drew Moseley wrote:
> >> Signed-off-by: Drew Moseley <drew_moseley at mentor.com>
> >> ---
> >> 
> >>  meta-oe/recipes-support/evtest/evtest_1.25.bb | 4 ++--
> >>  1 file changed, 2 insertions(+), 2 deletions(-)
> >> 
> >> diff --git a/meta-oe/recipes-support/evtest/evtest_1.25.bb
> >> b/meta-oe/recipes-support/evtest/evtest_1.25.bb index 640cec0..ccaa0c6
> >> 100644
> >> --- a/meta-oe/recipes-support/evtest/evtest_1.25.bb
> >> +++ b/meta-oe/recipes-support/evtest/evtest_1.25.bb
> >> @@ -8,7 +8,7 @@ LIC_FILES_CHKSUM =
> >> "file://COPYING;md5=751419260aa954499f7abaabaa882bbe">> 
> >>  DEPENDS = "libxml2"
> >>  
> >>  SRC_URI =
> >>  "http://cgit.freedesktop.org/~whot/evtest/snapshot/evtest-${PV}.tar.bz2
> >>  ;name=archive">> 
> >> -SRC_URI[archive.md5sum] = "770d6af03affe976bdbe3ad1a922c973"
> >> -SRC_URI[archive.sha256sum] =
> >> "3d34123c68014dae6f7c19144ef79ea2915fa7a2f89ea35ca375a9cf9e191473"
> >> +SRC_URI[archive.md5sum] = "0ef3fe5e20fa2dee8994827d48482902"
> >> +SRC_URI[archive.sha256sum] =
> >> "6e93ef54f0aa7d263f5486ce4a14cac53cf50036bfd20cf045fef2b27ee6664b">> 
> >>  inherit autotools pkgconfig
> > 
> > Why did these change?  It's really BAD practice to have a new/different
> > version of a program with an old name (hence different checksums).
> 
> No clue.  I downloaded them today and those were the sums that were there.

As a general rule, we can't just change signatures without some understanding 
of why they are changing; otherwise we could miss some tampering with the 
contents, the detection of which is the entire purpose of having the 
checksums.

In this specific instance the reason it has changed is almost certainly the 
fact that the source is being fetched from a cgit snapshot. These are not 
guaranteed to remain the same, so pointing to them in SRC_URI isn't really a 
good idea. FYI Otavio has already sent patches to switch over to fetching 
directly from git instead to this list a couple of days ago.

Cheers,
Paul

-- 

Paul Eggleton
Intel Open Source Technology Centre