From 4539b8a3d2495752038408cb178420385fe8d720 Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Tue, 18 Aug 2026 12:59:51 +0200 Subject: [PATCH 74/77] package/ask: guard downstream ASK patch copies against drift fmc and fmlib are fetched from nxp-qoriq upstream and libnfnetlink is the stock OpenWrt package, so the ASK extensions reach them only through the downstream patch copies under package/*/patches/. Nothing tied those copies to their ASK-repo masters, so a master reworked on the ASK side (or a hand-edit here) could ship silently out of sync. Add package/ask/ask-patch-sync.sha256 pinning the blessed sha of each of the three copies, and scripts/check-ask-patch-sync.sh: - Level 1 (always, both build modes): copies match the pinned shas. - Level 2 (when a local ASK checkout exists): the ASK masters match too, catching a master changed without re-syncing here. It fails loudly and never rewrites anything. mono-update.sh now runs it before tagging, so no release can ship a drifted copy. Co-Authored-By: Claude Opus 4.8 --- package/ask/ask-patch-sync.sha256 | 20 ++++++++++ scripts/check-ask-patch-sync.sh | 63 +++++++++++++++++++++++++++++++ scripts/mono-update.sh | 6 +++ 3 files changed, 89 insertions(+) create mode 100644 package/ask/ask-patch-sync.sha256 create mode 100755 scripts/check-ask-patch-sync.sh diff --git a/package/ask/ask-patch-sync.sha256 b/package/ask/ask-patch-sync.sha256 new file mode 100644 index 0000000000..f88a50501e --- /dev/null +++ b/package/ask/ask-patch-sync.sha256 @@ -0,0 +1,20 @@ +# ASK downstream-patch sync manifest — pinned blessed shas of the three +# downstream COPIES of ASK patch masters carried in this tree. +# +# fmc + fmlib are fetched from nxp-qoriq upstream and libnfnetlink is stock +# OpenWrt, so the ASK extensions reach those sources only through these copies. +# Their masters live in the ASK repo: +# package/ask/fmc/patches/100-mono-ask-extensions.patch +# <- ASK patches/fmc/01-mono-ask-extensions.patch +# package/ask/fmlib/patches/100-mono-ask-extensions.patch +# <- ASK patches/fmlib/01-mono-ask-extensions.patch +# package/libs/libnfnetlink/patches/900-nxp-ask-nonblocking-heap-buffer.patch +# <- ASK patches/libnfnetlink//01-nxp-ask-nonblocking-heap-buffer.patch +# +# When the ASK masters change, re-sync the copies AND update these shas in the +# SAME commit (lockstep). scripts/check-ask-patch-sync.sh enforces this and +# mono-update.sh gates every release on it. +# verify: grep -vE '^[[:space:]]*(#|$)' package/ask/ask-patch-sync.sha256 | sha256sum -c - +9da0c6ecbc6c978d3cbae3c5faa83b00db7ac89903807044191a118e0e8ad63b package/ask/fmc/patches/100-mono-ask-extensions.patch +000a60bcf3e4293cdcc3d59dbd37ff06020d65bfae11e7bf454e3263bb3fe02c package/ask/fmlib/patches/100-mono-ask-extensions.patch +332386759d63e187d30c9da3d3723803fd10b278a1e38eb4f83223eb7fd5d7a9 package/libs/libnfnetlink/patches/900-nxp-ask-nonblocking-heap-buffer.patch diff --git a/scripts/check-ask-patch-sync.sh b/scripts/check-ask-patch-sync.sh new file mode 100755 index 0000000000..ae3e443d94 --- /dev/null +++ b/scripts/check-ask-patch-sync.sh @@ -0,0 +1,63 @@ +#!/bin/sh +# Guard the downstream ASK patch copies in this tree against silent drift. +# +# fmc and fmlib are fetched from nxp-qoriq upstream and libnfnetlink is the +# stock OpenWrt package, so the ASK extensions reach those sources only through +# downstream patch COPIES under package/*/patches/. Their masters live in the +# ASK repo (patches/{fmc,fmlib,libnfnetlink/}/). This check: +# +# Level 1 (always, both build modes): every copy matches the blessed sha +# pinned in package/ask/ask-patch-sync.sha256. Needs only this tree. +# Level 2 (only when a local ASK checkout is on disk): each ASK master also +# matches, catching a master edited without re-syncing the copy here. +# Skipped with a note under the remote github pin / CI (no ASK checkout). +# +# Fails loudly (nonzero) on any mismatch; never writes anything. The ASK +# checkout dir is $ASK_DIR, else ../../ASK relative to the repo root. +set -eu + +cd "$(dirname "$0")/.." +MANIFEST=package/ask/ask-patch-sync.sha256 +[ -f "$MANIFEST" ] || { echo "check-ask-patch-sync: $MANIFEST missing" >&2; exit 1; } + +# --- Level 1: copies match the pinned manifest (comment / blank-line tolerant) --- +if ! grep -vE '^[[:space:]]*(#|$)' "$MANIFEST" | sha256sum -c - >/dev/null 2>&1; then + echo "check-ask-patch-sync: FAIL (Level 1) - a tracked ASK patch copy does not" >&2 + echo " match its pinned sha in $MANIFEST. Either an edit landed here without" >&2 + echo " updating the manifest, or a re-sync from the ASK masters is incomplete." >&2 + echo " Inspect: grep -vE '^[[:space:]]*(#|\$)' $MANIFEST | sha256sum -c -" >&2 + exit 1 +fi +echo "check-ask-patch-sync: Level 1 OK - copies match $MANIFEST" + +# --- Level 2: masters match, only when a local ASK checkout is present --- +ASK=${ASK_DIR:-../../ASK} +if [ ! -d "$ASK/patches" ]; then + echo "check-ask-patch-sync: Level 2 skipped - no ASK checkout at '$ASK' (set ASK_DIR to enable)" + exit 0 +fi + +# libnfnetlink's master is version-scoped; track the package's PKG_VERSION. +LNV=$(sed -n 's/^PKG_VERSION:=//p' package/libs/libnfnetlink/Makefile 2>/dev/null | head -1) +for map in \ + "package/ask/fmc/patches/100-mono-ask-extensions.patch|patches/fmc/01-mono-ask-extensions.patch" \ + "package/ask/fmlib/patches/100-mono-ask-extensions.patch|patches/fmlib/01-mono-ask-extensions.patch" \ + "package/libs/libnfnetlink/patches/900-nxp-ask-nonblocking-heap-buffer.patch|patches/libnfnetlink/${LNV}/01-nxp-ask-nonblocking-heap-buffer.patch"; do + copy=${map%%|*} + master="$ASK/${map#*|}" + if [ ! -f "$master" ]; then + echo "check-ask-patch-sync: FAIL (Level 2) - ASK master not found: $master" >&2 + echo " (libnfnetlink master path tracks PKG_VERSION=$LNV; bump lockstep on upgrade)" >&2 + exit 1 + fi + cs=$(sha256sum "$copy" | cut -d' ' -f1) + ms=$(sha256sum "$master" | cut -d' ' -f1) + if [ "$cs" != "$ms" ]; then + echo "check-ask-patch-sync: FAIL (Level 2) - copy has drifted from ASK master:" >&2 + echo " copy $cs $copy" >&2 + echo " master $ms $master" >&2 + echo " Re-sync the copy and update $MANIFEST in the SAME commit (lockstep)." >&2 + exit 1 + fi +done +echo "check-ask-patch-sync: Level 2 OK - 3 masters match at $ASK" diff --git a/scripts/mono-update.sh b/scripts/mono-update.sh index 5f13533db3..cf6e23867f 100755 --- a/scripts/mono-update.sh +++ b/scripts/mono-update.sh @@ -38,6 +38,12 @@ done exit 1 } +# The downstream ASK patch copies (fmc/fmlib/libnfnetlink) must match their +# pinned shas - and the ASK masters when a checkout is on disk - so a re-synced +# but unpinned (or hand-edited) patch can never ship silently. Fail before we +# tag or build. See scripts/check-ask-patch-sync.sh. +scripts/check-ask-patch-sync.sh + git fetch --quiet origin 'refs/tags/v*:refs/tags/v*' # Deliberately tracks only the current minor series (v25.12.x patch -- 2.47.3