diff options
| author | Leah Rowe <leah@libreboot.org> | 2023-09-09 16:39:26 +0100 |
|---|---|---|
| committer | Leah Rowe <leah@libreboot.org> | 2023-09-09 16:39:26 +0100 |
| commit | 878550d51949cec38cc475c1ec87b968e8fbec6b (patch) | |
| tree | ee1df97bb23ed2b13413853324542f9cc4ae53ed /script/update/blobs/inject | |
| parent | 022e0200df14222cee54dddf5faada1177f97319 (diff) | |
use sha512sum to check downloads, not sha1sum
sha-1 has known collision issues, which may not be readily
exploitable yet (in our context), but we should ideally use
a more secure method for checking file integrity.
therefore, use sha-2 (sha512sum) for checking files. this is
slower than sha-1, but checksum verification is only a minor
part of what lbmk does, so the overall effect on build times
is quite negligible.
Signed-off-by: Leah Rowe <leah@libreboot.org>
Diffstat (limited to 'script/update/blobs/inject')
| -rwxr-xr-x | script/update/blobs/inject | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/script/update/blobs/inject b/script/update/blobs/inject index ab943a3c..10691658 100755 --- a/script/update/blobs/inject +++ b/script/update/blobs/inject @@ -127,7 +127,10 @@ patch_release_roms() ( cd "${_tmpdir}"/bin/* - sha1sum --status -c blobhashes || \ + + # NOTE: For compatibility with older rom releases, defer to sha1 + sha512sum --status -c blobhashes || \ + sha1sum --statuc -c blobhashes || \ err "patch_release_roms: ROMs did not match expected hashes" ) |