[tor-bugs] #8283 [Tor bundles/installation]: track hashes for all TBB dep source files

[Tor Bug Tracker & Wiki]

#8283: track hashes for all TBB dep source files
--------------------------------------+-------------------------------------
 Reporter:  ioerror                   |          Owner:  ioerror     
     Type:  enhancement               |         Status:  needs_review
 Priority:  normal                    |      Milestone:              
Component:  Tor bundles/installation  |        Version:              
 Keywords:                            |         Parent:  #8288       
   Points:                            |   Actualpoints:              
--------------------------------------+-------------------------------------

Comment(by ioerror):

 Replying to [comment:6 arma]:
 > So when some component changes, somebody edits the versions.mk file by
 hand?
 >
 > That isn't going to work for people who don't like text editors, or when
 lots of things change. Maybe there should be a script to take a bunch of
 files and generate that file-with-hashes out of them? Then when there's a
 new thing, you fetch it, rerun the script, and commit the new file.
 >

 The build process is not for people who cannot use a text editor or build
 software in a terminal.

 > And if the versions.mk file does other stuff too, then it may be wisest
 to keep the auto-generated stuff as a separate file.
 >

 Currently, it is populated with manual data - eg: version numbers and
 urls.

 > I guess it looks like versions.mk had versions in it before, not just
 hashes, so the problem I describe here might not be a new problem.

 No, I don't think so. If we update the version, we should ensure we also
 either verify the download (and add the hash of the file at the same time)
 or we should probably not update the version.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8283#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online