From d32791840f064a12e279d7a67625ae605b8b5286 Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Wed, 12 Aug 2026 01:24:41 +0200 Subject: [PATCH 41/62] ask, fancontrol: pin real PKG_MIRROR_HASH (drop :=skip) Every mono ASK package (ask-modules, cmm, dpa-app, libcli, fmc, fmlib) and the fancontrol package used PKG_MIRROR_HASH:=skip, disabling the integrity check on the fetched vendor tarball - a corrupted or tampered mirror archive would have built silently. Pin the real mirror-tarball hashes (computed with `make /check FIXUP=1`), so a mismatched download now fails the build. ask-modules/cmm/dpa-app share the we-are-mono/ASK tarball (one hash); libcli, fmc, fmlib and fancontrol carry their own upstream source hashes. Re-run `make package//check FIXUP=1` to re-pin after any PKG_SOURCE_VERSION bump. Co-Authored-By: Claude Opus 4.8 --- package/ask/ask-modules/Makefile | 2 +- package/ask/cmm/Makefile | 2 +- package/ask/dpa-app/Makefile | 2 +- package/ask/fmc/Makefile | 2 +- package/ask/fmlib/Makefile | 2 +- package/ask/libcli/Makefile | 2 +- package/mono/fancontrol/Makefile | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package/ask/ask-modules/Makefile b/package/ask/ask-modules/Makefile index 247076a55e..85468bdac9 100644 --- a/package/ask/ask-modules/Makefile +++ b/package/ask/ask-modules/Makefile @@ -10,7 +10,7 @@ PKG_SOURCE_URL:=$(ASK_SOURCE_URL) PKG_SOURCE_VERSION:=$(ASK_VERSION) PKG_SOURCE:=$(ASK_SOURCE) PKG_SOURCE_SUBDIR:=ask-$(ASK_VERSION) -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=3f103fc63bcd0d5de52305019e59d162fa30dd26e768b87bfd537c4232546e0a PKG_LICENSE:=GPL-2.0 diff --git a/package/ask/cmm/Makefile b/package/ask/cmm/Makefile index 550d9a589b..cba1ef1754 100644 --- a/package/ask/cmm/Makefile +++ b/package/ask/cmm/Makefile @@ -10,7 +10,7 @@ PKG_SOURCE_URL:=$(ASK_SOURCE_URL) PKG_SOURCE_VERSION:=$(ASK_VERSION) PKG_SOURCE:=$(ASK_SOURCE) PKG_SOURCE_SUBDIR:=ask-$(ASK_VERSION) -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=3f103fc63bcd0d5de52305019e59d162fa30dd26e768b87bfd537c4232546e0a PKG_BUILD_DIR:=$(BUILD_DIR)/cmm-ask-$(ASK_VERSION) PKG_BUILD_PARALLEL:=1 diff --git a/package/ask/dpa-app/Makefile b/package/ask/dpa-app/Makefile index 4bbf9b8ae7..3e8c77941f 100644 --- a/package/ask/dpa-app/Makefile +++ b/package/ask/dpa-app/Makefile @@ -10,7 +10,7 @@ PKG_SOURCE_URL:=$(ASK_SOURCE_URL) PKG_SOURCE_VERSION:=$(ASK_VERSION) PKG_SOURCE:=$(ASK_SOURCE) PKG_SOURCE_SUBDIR:=ask-$(ASK_VERSION) -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=3f103fc63bcd0d5de52305019e59d162fa30dd26e768b87bfd537c4232546e0a PKG_BUILD_DIR:=$(BUILD_DIR)/dpa-app-ask-$(ASK_VERSION) PKG_BUILD_DEPENDS:=fmlib fmc diff --git a/package/ask/fmc/Makefile b/package/ask/fmc/Makefile index 1b1487a21e..c3f740be9f 100644 --- a/package/ask/fmc/Makefile +++ b/package/ask/fmc/Makefile @@ -8,7 +8,7 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://github.com/nxp-qoriq/fmc PKG_SOURCE_VERSION:=15a31335e254ba18134244bfd6dc57304a0cbfb4 -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=b76a583985d0db33580e6ae9b1ec66bf3c99bbc685a432c1324ceca17ab5ad4b PKG_BUILD_PARALLEL:=0 PKG_LICENSE:=MIT diff --git a/package/ask/fmlib/Makefile b/package/ask/fmlib/Makefile index d72cac6e33..fc08e9f0ba 100644 --- a/package/ask/fmlib/Makefile +++ b/package/ask/fmlib/Makefile @@ -8,7 +8,7 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://github.com/nxp-qoriq/fmlib PKG_SOURCE_VERSION:=79c5c2ec2e1262b6331bd5f864d7bd60c310923c -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=cc8ce07238c180548082c3771aa2ab55e5117830233960d3945a1c5565b67145 PKG_BUILD_PARALLEL:=0 PKG_LICENSE:=BSD-3-Clause GPL-2.0 diff --git a/package/ask/libcli/Makefile b/package/ask/libcli/Makefile index 93fc9bf00b..59d83db401 100644 --- a/package/ask/libcli/Makefile +++ b/package/ask/libcli/Makefile @@ -7,7 +7,7 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://github.com/dparrish/libcli PKG_SOURCE_VERSION:=dcfd3b72a5587c11b54c25d7ffe69bd7e03acb59 -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=a9842266ae80f78b838f71c98bbfeed6c7082fadedd2d9a301aedc3e47a88af7 PKG_LICENSE:=LGPL-2.1 PKG_LICENSE_FILES:=COPYING diff --git a/package/mono/fancontrol/Makefile b/package/mono/fancontrol/Makefile index 6de579d440..46c296626c 100644 --- a/package/mono/fancontrol/Makefile +++ b/package/mono/fancontrol/Makefile @@ -10,7 +10,7 @@ PKG_RELEASE:=1 PKG_SOURCE_PROTO:=git PKG_SOURCE_URL:=https://github.com/lm-sensors/lm-sensors PKG_SOURCE_VERSION:=1667b850a1ce38151dae17156276f981be6fb557 -PKG_MIRROR_HASH:=skip +PKG_MIRROR_HASH:=f2d3080aa080de4b93c57b2588a73836d6f6b47bfbe05993d63828694591afbc PKG_LICENSE:=GPL-2.0-or-later -- 2.47.3