Re: [bitbake-devel] [PATCH v2] bitbake-setup: use bb.fetch for buildtools installer download

Hi Alex,

Thanks for the review.

1. --default — sure, will add.
2. fetcher. Unpack() — good point, I'll use that instead of reaching into DL_DIR directly
3. The explicit sha256 check — you're right, this was added because automated reviewers pointed out that file://
  doesn't enforce checksums.  I'll drop the explicit check
4. Putting install-buildtools inside configurations — makes sense for the future. Want me to do that now or as a
  follow-up?

I will send v3 with above corrections.

Regards,
Jaipaul Cheernam

🔗 EST Website<https://www.est.tech/>
🔗 EST LinkedIn<https://www.linkedin.com/company/ericsson-software-technology/>

From: Alexander Kanavin <[email protected]>
Date: Friday, 26 June 2026 at 18:48
To: Jaipaul Cheernam <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [bitbake-devel] [PATCH v2] bitbake-setup: use bb.fetch for buildtools installer download

On Fri, 26 Jun 2026 at 15:43, Jaipaul Cheernam via
lists.openembedded.org
<[email protected]> wrote:
> When url and sha256sum are configured, download the buildtools
> installer via bb.fetch with checksum enforcement. The file is
> cached in DL_DIR and passed to install-buildtools via --local-file.

Thanks, this basically looks ok, but I have a few review points.

> If no install-buildtools config is present, fall back to calling
> install-buildtools directly (preserving existing default behaviour).
>
> CLI overrides available via --url and --sha256.

I think there should also be a --default command line option, which
would similarly fall back to getting and installing the default
buildtools even if config file specifies something else.

> +    # Locate the downloaded file
> +    local_path = fetcher.localpath(src_uri)
> +
> +    if not os.path.exists(local_path):
> +        logger.error("Downloaded file not found at expected location")
> +        sys.exit(1)

I would rather use fetcher.unpack(), than use the file directly from
DL_DIR. It's better to only allow the fetcher to touch content of
DL_DIR.

> +    # Verify checksum explicitly (file:// fetcher does not enforce checksums)
> +    actual_sha256 = bb.utils.sha256_file(local_path)
> +    if actual_sha256 != sha256:
> +        logger.error("Checksum mismatch for buildtools installer:\n"
> +                     "  expected: %s\n"
> +                     "  actual:   %s" % (sha256, actual_sha256))
> +        sys.exit(1)

This I don't quite understand. Why is the checksum verified again if
the fetcher already did it? Why is file:// fetcher mentioned? AI
confusion?

> +   "bitbake-setup": {
> +       "install-buildtools": {
> +           "url": "https://example.com/buildtools/x86_64-buildtools-extended-nativesdk-standalone-5.0.sh",
> +           "sha256sum": "af76648b..."
> +       },
> +       "configurations": [ ... ]
> +   }

I wonder if the 'install-buildtools' block should be defined inside a
particular configuration. Configurations can be nested, so that still
allows defining a single buildtools for all of them, but this would
also allow specifying separate buildtools for particular
configurations. I'm not sure if a use case for that will arise, but at
least bitbake-setup will be ready for it. What you think?

Alex