search

vn971 / rua

Build tool for Arch Linux providing control, review and jailed build options
GNU General Public License v3.0
424 stars 42 forks source link

Add support for BLAKE2 checksums #138

Closed joanbm closed 3 years ago

joanbm commented 3 years ago

Their existence and usage are documented on ArchWiki: https://wiki.archlinux.org/index.php?title=PKGBUILD&oldid=635970#b2sums

Adding support for them simply involves handling them similarly to the other already supported checksum types (sha1sums, sha256sums, etc.)

srcinfo.rs is updated since the old version didn't support BLAKE2 either

This has two effects:

vn971 commented 3 years ago

Hi, that's nice, and I personally find b2 to be a good and valuable hash as well. (And regardless of personal preferences, it would make sense to support whatever's supported by Arch itself.)

I'll take a detailed look at the PR a bit later, to check that nothing is missing

vn971 commented 3 years ago

With regards to checking packages:

When building packages offline ('rua builddir --offline' or 'rua install --offline'), the BLAKE2 checksums are checked instead of ignored.

Rua does not build packages completely on its own, and instead, still makes a makepkg invocation. If you know for a fact that b2sums are ignored by rua anyway, then it's strange and I'd like to investigate that. Do you observed this in your environment or was it a hypothesis? (I'll also check in my env.)

vn971 commented 3 years ago

Thanks, merged! The question on skipping b2sums is still open to me

joanbm commented 3 years ago

Hi! Thanks for merging. I was somewhat unclear/misleading about what I meant by "When building packages offline, the BLAKE2 checksums are checked instead of ignored."

When building in offline mode, there are two makepkg invocations, one to download the sources and one to do the actual build. The one to download the sources didn't check the BLAKE2 checksums - but did check other kinds of checksums. That's because rua creates a temporary PKGBUILD to download the sources and the BLAKE2 checksums weren't copied there unlike other kinds of checksums (in the code that's download_srcinfo_sources which calls static_pkgbuild where I made the change). However, when doing the actual build, the original PKGBUILD is used, which re-runs the checksum checks again, and there BLAKE2 checksums are actually checked, so they weren't skipped altogether. Example:

boost_rua_b2sums

So it's not terribly important that BLAKE2 checksums weren't checked while downloading the sources since they are re-checked during the build anyway, but it's nice to have them checked on download for consistency and so the build fails as early as possible.