The rationale: bd2c77f4c2 (commitcomment-21229420)
> If you absolutely want to disable secure transport I think it'd be a
> better choice to use the http:// protocol instead, making the
> insecurity unambiguously visible in logs/screen output. (Not sure if
> GitLab supports it, but the first two does I think.)
Regular downloads of packages are verified by checksums, so
--no-check-certificate doesn't compromise the build system,
but the checksums themselves are often updated with update-checksum-%
which in turn calls the regular package download mechanism, so there
is a possibility of downloading and sealing a poisoned file.
On the one hand, old systems may still rely on --no-check-certificate,
so it is not nice to completely disable it for regular downloads.
However keeping this option enabled for backup servers only is enough
to support such systems because of the fallback mechanism.
On the other hand, download from a backup doesn't make sense while
updating a package, because the package is definetely not in the backup yet.
So --no-check-certificate is now enabled only for backup servers
and backup servers are disabled while updating packages.
See https://github.com/mxe/mxe/pull/1694#issuecomment-285324739
- move cmake configuration from mxe-conf to cmake-conf
- replace `echo` with templates for readability and maintenance
- allow packages to set other dep files
- set CMAKE_POLICY_DEFAULT_CMPNNNN in wrapper since
`cmake_minimum_required` or `cmake_policy` can't be set in
toolchain (closes#971)
Minimal implementation to strip the [largest files][lf-gist] by
default, mostly made up of gcc/binutils and test programs.
gdal and geos both produce large libraries, but the libs themselves
aren't worth stripping, it's the 20 odd programs produced by gdal
with those libs statically linked that consume the most space.
I'm leaving these undocumented as the defaults seems reasonable and
the interface may well change when we enable debug/release variants.
closes#985closes#1249
[lf-gist]:https://github.com/mxe/mxe/issues/1249#issuecomment-193392038
Parameter $(PKG)_UA overrides default user agent used by wget to download
a package. It is needed, because download server www.ics.forth.gr from where
levmar is downloaded, crashes on default user agent Wget/1.13.4.
User agent for levmar was set to MXE. Now the server works.
see https://github.com/mxe/mxe/issues/1519
The following script was applied:
sed ':a;/part of MXE.$/{N;s/\n//;ba}' -i $(git grep -l 'part of MXE')
sed 's/\(part of MXE\).*\(See index.html\)/\1. \2/' -i \
$(git grep -l 'part of MXE.*See index.html')
before='This file is part of MXE. See index.html for further information.'
after='This file is part of MXE. See LICENSE.md for licensing information.'
sed "s/$before/$after/" -i $(git grep -l 'part of MXE')
Then git grep 'index.html for further information' revealed two other files.
One of them was patched manually (patch.mk). Makefile has text
"See index.html for further information" unrelated to licensing.
See https://github.com/mxe/mxe/issues/1500#issuecomment-241340792
Removing MXE directory with "rm -rf" used to fail on file
usr/readonly/.gitkeep because directory usr/readonly was readonly.
Now readonly directory is created in tmp-* directory and .gitkeep
is not created for it (because tmp-* is not under usr/).
Problems with removing MXE directory are fixed even in case
of interrupted build.
fix#1221
Tony Theodore
Boris Nagaev
Viktor Szakats