From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] make.sh: Explicitely check the source tarballs
Date: Sat, 21 Dec 2024 10:54:42 +0000
Message-ID: <20241221105442.2607315-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============9083678321589349914=="
List-Id: <development.lists.ipfire.org>

--===============9083678321589349914==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

The Makefiles do not automatically perform the check that I expected
them to perform when running a build. They check if the source tarballs
are all present, but they don't check whether they match the checksum.
This is only being done when "./make.sh downloadsrc" is being run.

In case of the automated builds, we explicitely run "./make.sh
downloadsrc", so I don't think that this might have introduced any
malicious source into the published builds.

Reported-by: Stephen Cuka <stephen(a)firemypi.org>
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 make.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/make.sh b/make.sh
index ee098d9a3..4f2a66b09 100755
--- a/make.sh
+++ b/make.sh
@@ -939,7 +939,7 @@ lfsmake1() {
 		exiterror "Downloading ${pkg}"
 	fi
=20
-	if ! make_pkg --timer=3D"update_runtime" "${pkg}" TOOLCHAIN=3D1 ROOT=3D"${B=
UILD_DIR}" "$@"; then
+	if ! make_pkg --timer=3D"update_runtime" "${pkg}" TOOLCHAIN=3D1 ROOT=3D"${B=
UILD_DIR}" b2 "$@"; then
 		print_status FAIL
=20
 		exiterror "Building ${pkg}"
@@ -962,7 +962,7 @@ lfsmake2() {
 	fi
=20
 	# Run install on the package
-	if ! make_pkg --chroot --timer=3D"update_runtime" "${pkg}" install "$@"; th=
en
+	if ! make_pkg --chroot --timer=3D"update_runtime" "${pkg}" b2 install "$@";=
 then
 		print_status FAIL
=20
 		exiterror "Building ${pkg}"
--=20
2.39.5


--===============9083678321589349914==--