NoahandClaude Fable 5.1
2b6e8a2098
Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded settings directory and root-only staged rootfs permissions with their own tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they download, and ASCII typography throughout. Each fix carries its test under qemu/tests or tests/. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj
67 lines
2.6 KiB
Bash
Executable File
67 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch (with retries) and sha256-verify the pristine Buildroot tarball into $1.
|
|
#
|
|
# WHY THIS EXISTS. The firmware builds against
|
|
# sysdrv/source/buildroot/buildroot-2025.02.8 inside the vendor SDK. That tree
|
|
# is NOT in the vendor checkout -- the SDK ships 2023.02.6 -- and nothing
|
|
# recorded where it came from, so the build was reproducible only on the one
|
|
# machine that happened to have the directory (flare-edge#135). Buildroot signs
|
|
# its releases with GPG rather than publishing a .sha256, so the pin here was
|
|
# computed from the downloaded tarball and is what this script verifies against.
|
|
#
|
|
# Same shape as fetch-kernel-tarball.sh, deliberately: a version bump edits this
|
|
# file and the pin beside it, nothing else. FAILS CLOSED on a missing pin.
|
|
#
|
|
# Not wired into build-firmware.sh or CI yet -- tools/build-firmware.sh stages
|
|
# sdk-patches/buildroot/ onto whatever buildroot tree the vendor SDK already
|
|
# has, it does not yet extract this pinned tarball over it. Exercised today by
|
|
# tests/fetch-buildroot-tarball/run-fetch-buildroot-tarball-tests.sh and by
|
|
# running the script by hand; wiring it into the real build path is a separate
|
|
# change (it has to reconcile the pristine tree with the existing SDK buildroot
|
|
# checkout first).
|
|
#
|
|
# Usage: fetch-buildroot-tarball.sh <destination-path>
|
|
set -euo pipefail
|
|
|
|
BRVER=2025.02.8
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" # build/
|
|
SHA_FILE="$HERE/buildroot-$BRVER.tar.xz.sha256"
|
|
URL="https://buildroot.org/downloads/buildroot-$BRVER.tar.xz"
|
|
|
|
TB="${1:?usage: fetch-buildroot-tarball.sh <destination-path>}"
|
|
|
|
[ -f "$SHA_FILE" ] || {
|
|
echo "FATAL: no pinned sha256 for buildroot-$BRVER (expected $SHA_FILE):" >&2
|
|
echo " refusing an unverified tarball" >&2
|
|
exit 1
|
|
}
|
|
WANT="$(awk '{print $1; exit}' "$SHA_FILE")"
|
|
|
|
verify() {
|
|
[ -f "$TB" ] || return 1
|
|
local got
|
|
got="$(sha256sum "$TB" | awk '{print $1}')"
|
|
[ "$got" = "$WANT" ]
|
|
}
|
|
|
|
if verify; then
|
|
echo "buildroot-$BRVER: already present and verified"
|
|
exit 0
|
|
fi
|
|
|
|
for attempt in 1 2 3; do
|
|
echo "== fetching buildroot-$BRVER (attempt $attempt)"
|
|
# --retry only re-fires once curl decides a transfer has failed; a connection
|
|
# that opens and then stalls (blackholed route, hung proxy) never reaches
|
|
# that decision and would otherwise block forever. --connect-timeout bounds
|
|
# the handshake, --max-time bounds the whole request.
|
|
if curl -fsSL --retry 2 --connect-timeout 20 --max-time 120 -o "$TB" "$URL" && verify; then
|
|
echo "buildroot-$BRVER: sha256 verified"
|
|
exit 0
|
|
fi
|
|
rm -f "$TB"
|
|
done
|
|
|
|
echo "FATAL: could not fetch a buildroot-$BRVER tarball matching $WANT" >&2
|
|
exit 1
|