[FEATURE/SECURITY/BUG] Add hash key validation to check the files downloaded from external projects #3418

Activity

1. acassis

   added

   Type: BugSomething isn't workingSomething isn't working

   on Mar 3, 2026
2. acassis

   changed the title [-][FEATURE/SECURITY/BUG] Add harsh key validation to check the files downloaded from external projects[/-] [+][FEATURE/SECURITY/BUG] Add hash key validation to check the files downloaded from external projects[/+] on Mar 4, 2026
3. Swatantra-66 commented on Oct 10, 2026

   

   Swatantra-66

   on Oct 10, 2026

   Contributor

   More actions

   Hi @acassis,

   I would like to take this up!

   Looking into the repository, we actually already have apps/tools/check-hash.sh in tree (added around NuttX 7.29), but currently only 5 packages (inih, psmq, embedlog, rtttl-c, morsey) utilize it. Flagship packages like LVGL, zlib, and others still download archives without validation.

   I propose the following approach:

   1. Enhance apps/tools/check-hash.sh:

      • Add md5 support alongside sha1|sha224|sha256|sha384|sha512.
      • Replace legacy which checks with POSIX command -v.
      • Add a fallback to Python 3's hashlib if neither <algo>sum nor shasum is available on the host build environment.
      • Normalize hash comparison to be case-insensitive.

   2. Standardize Makefile & CMake Integration:

      • Define CHECKHASH ?= $(APPDIR)/tools/check-hash.sh centrally in apps/Make.defs so individual Makefiles do not need ad-hoc tool paths.
      • Allow optional hash overrides (e.g., LVGL_SHA256 ?= ...), skipping validation gracefully only if an upstream hash is explicitly cleared or pointing to an unversioned dev branch.
      • Add matching URL_HASH validation in CMakeLists.txt (FetchContent_Declare).

   3. Rollout:

      • Start with graphics/lvgl (and optionally system/zlib) as the primary pilot PR, followed by rolling it out systematically to the remaining external packages.

   Please let me know if this plan looks good to you, and feel free to assign this issue to me.
4. cederom commented on Oct 11, 2026

   

   cederom

   on Oct 11, 2026

   Contributor

   More actions

   Thanks @Swatantra-66 yes please provide the PR with solution proposition :-)

   • MD5 is not considered secure, we should use SHA256+ where possible.
   • okay to replace which with command -v.
   • For now I would avoid Python in the *.sh scripts. We have clear separation of interpreters and dependencies. Python became moving target while shell is stable. We may want to fallback to pythoh when we hit a wall with existing problem, or create a dedicated python script for that. For now please avoid mixing the Python in.
   • okay with lowercase hash comaprison.
   • okay with CHECKHASH centralization in apps/Make.defs.
   • okay with optional overrides.
   • okay with example implementation in graphics/lvgl and system/zlib.

   Thank you and have fun! :-)

   👍React with 👍1Reacted by Swatantra Yadav
5. Swatantra-66 commented on Oct 11, 2026

   

   Swatantra-66

   on Oct 11, 2026

   Contributor

   More actions

   Thanks @cederom! I have submitted the proposal in #3833 incorporating all the points discussed. Looking forward to your review! :-)
6. Swatantra-66

   added 2 commits that reference this issue on Oct 11, 2026

   tools/check-hash: add checksum validation for external downloads

   ...

   This issue will close once commit 0239c5b is merged into the 'master' branch.

   0239c5b

   tools/check-hash: add checksum validation for external downloads

   ...

   This issue will close once commit 1185607 is merged into the 'master' branch.

   1185607