kumquat-buildroot/docs/manual/customize-patches.adoc

84 lines
3.3 KiB
Plaintext
Raw Normal View History

// -*- mode:doc -*- ;
// vim: set syntax=asciidoc:
package/pkg-download: lookup hash files in global-patch-dir Currently, we expect and only use hash files that lie within the package directory, alongside the .mk file. Those hash files are thus bundled with Buildroot. This implies that only what's known to Buildroot can ever get into those hash files. For packages where the version is fixed (or a static choice), then we can carry hashes for those known versions. However, we do have a few packages for which the version is a free-form entry, where the user can provide a custom location and/or version. like a custom VCS tree and revision, or a custom tarball URL. This means that Buildroot has no way to be able to cary hashes for such custom versions. This means that there is no integrity check that what was downloaded is what was expected. For a sha1 in a git tree, this is a minor issue, because the sha1 by itself is already a hash of the expected content. But for custom tarballs URLs, or for a tag in a VCS, there is indeed no integrity check. Buildroot can't provide such hashes, but interested users may want to provide those, and currently there is no (easy) way to do so. We leverage the existing global-patch-dir mechanism to look for extra hash files. We use the same heuristic that is used for bundled hash files, and for each global patch directory <dir>, we use the first file to exist among: 1. look into <dir>/<package>/<version>/<package>.hash 2. look into <dir>/<package>/<package>.hash Reported-by: "Martin Zeiser (mzeiser)" <mzeiser@cisco.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-11-06 20:09:13 +01:00
=== Adding project-specific patches and hashes
[[customize-patches]]
package/pkg-download: lookup hash files in global-patch-dir Currently, we expect and only use hash files that lie within the package directory, alongside the .mk file. Those hash files are thus bundled with Buildroot. This implies that only what's known to Buildroot can ever get into those hash files. For packages where the version is fixed (or a static choice), then we can carry hashes for those known versions. However, we do have a few packages for which the version is a free-form entry, where the user can provide a custom location and/or version. like a custom VCS tree and revision, or a custom tarball URL. This means that Buildroot has no way to be able to cary hashes for such custom versions. This means that there is no integrity check that what was downloaded is what was expected. For a sha1 in a git tree, this is a minor issue, because the sha1 by itself is already a hash of the expected content. But for custom tarballs URLs, or for a tag in a VCS, there is indeed no integrity check. Buildroot can't provide such hashes, but interested users may want to provide those, and currently there is no (easy) way to do so. We leverage the existing global-patch-dir mechanism to look for extra hash files. We use the same heuristic that is used for bundled hash files, and for each global patch directory <dir>, we use the first file to exist among: 1. look into <dir>/<package>/<version>/<package>.hash 2. look into <dir>/<package>/<package>.hash Reported-by: "Martin Zeiser (mzeiser)" <mzeiser@cisco.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-11-06 20:09:13 +01:00
==== Providing extra patches
It is sometimes useful to apply 'extra' patches to packages - on top of
those provided in Buildroot. This might be used to support custom
features in a project, for example, or when working on a new
architecture.
The +BR2_GLOBAL_PATCH_DIR+ configuration option can be used to specify
a space separated list of one or more directories containing package
patches.
For a specific version +<packageversion>+ of a specific package
+<packagename>+, patches are applied from +BR2_GLOBAL_PATCH_DIR+ as
follows:
. For every directory - +<global-patch-dir>+ - that exists in
+BR2_GLOBAL_PATCH_DIR+, a +<package-patch-dir>+ will be determined as
follows:
+
* +<global-patch-dir>/<packagename>/<packageversion>/+ if the
directory exists.
+
* Otherwise, +<global-patch-dir>/<packagename>+ if the directory
exists.
. Patches will then be applied from a +<package-patch-dir>+ as
follows:
+
* If a +series+ file exists in the package directory, then patches are
applied according to the +series+ file;
+
* Otherwise, patch files matching +*.patch+ are applied in
alphabetical order. So, to ensure they are applied in the right
order, it is highly recommended to name the patch files like this:
+<number>-<description>.patch+, where +<number>+ refers to the
'apply order'.
For information about how patches are applied for a package, see
xref:patch-apply-order[]
The +BR2_GLOBAL_PATCH_DIR+ option is the preferred method for
specifying a custom patch directory for packages. It can be used to
specify a patch directory for any package in buildroot. It should also
be used in place of the custom patch directory options that are
available for packages such as U-Boot and Barebox. By doing this, it
will allow a user to manage their patches from one top-level
directory.
The exception to +BR2_GLOBAL_PATCH_DIR+ being the preferred method for
specifying custom patches is +BR2_LINUX_KERNEL_PATCH+.
+BR2_LINUX_KERNEL_PATCH+ should be used to specify kernel patches that
are available at a URL. *Note:* +BR2_LINUX_KERNEL_PATCH+ specifies kernel
patches that are applied after patches available in +BR2_GLOBAL_PATCH_DIR+,
as it is done from a post-patch hook of the Linux package.
package/pkg-download: lookup hash files in global-patch-dir Currently, we expect and only use hash files that lie within the package directory, alongside the .mk file. Those hash files are thus bundled with Buildroot. This implies that only what's known to Buildroot can ever get into those hash files. For packages where the version is fixed (or a static choice), then we can carry hashes for those known versions. However, we do have a few packages for which the version is a free-form entry, where the user can provide a custom location and/or version. like a custom VCS tree and revision, or a custom tarball URL. This means that Buildroot has no way to be able to cary hashes for such custom versions. This means that there is no integrity check that what was downloaded is what was expected. For a sha1 in a git tree, this is a minor issue, because the sha1 by itself is already a hash of the expected content. But for custom tarballs URLs, or for a tag in a VCS, there is indeed no integrity check. Buildroot can't provide such hashes, but interested users may want to provide those, and currently there is no (easy) way to do so. We leverage the existing global-patch-dir mechanism to look for extra hash files. We use the same heuristic that is used for bundled hash files, and for each global patch directory <dir>, we use the first file to exist among: 1. look into <dir>/<package>/<version>/<package>.hash 2. look into <dir>/<package>/<package>.hash Reported-by: "Martin Zeiser (mzeiser)" <mzeiser@cisco.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-11-06 20:09:13 +01:00
[[customize-hashes]]
==== Providing extra hashes
Buildroot bundles a xref:adding-packages-hash[list of hashes] against
which it checks the integrity of the downloaded archives, or of those
it generates locally from VCS checkouts. However, it can only do so
for the known versions; for packages where it is possible to specify
a custom version (e.g. a custom version string, a remote tarball URL,
or a VCS repository location and changeset), Buildroot can't carry
hashes for those.
For users concerned with the integrity of such downloads, it is possible
to provide a list of hashes that Buildroot can use to check arbitrary
downloaded files. Those extra hashes are looked up similarly to the
extra patches (above); for each directory in +BR2_GLOBAL_PATCH_DIR+,
the first file to exist is used to check a package download:
* +<global-patch-dir>/<packagename>/<packageversion>/<packagename>.hash+
* +<global-patch-dir>/<packagename>/<packagename>.hash+
The +utils/add-custom-hashes+ script can be used to generate these files.