Hi Paul, my understanding is that my change does not impact the package feed. Checksums are still always calculated for the normal package feed after my change. There are two different code paths:
1. do_package_index (package-index.bb -> generate_index_files() -> OpkgIndexer(d, DEPLOY_DIR_IPK).write_index()): operates on the global DEPLOY_DIR_IPK. This is the feed that can be published, externally signed, or served over a network. This path is not touched by this commit: it still always writes checksums. This is the write_index() call at meta/lib/oe/package_manager/__init__.py:579 2. do_rootfs (OpkgPM.write_index()): operates on WORKDIR/oe-rootfs-repo, a throwaway local copy of packages assembled exclusively for the current rootfs build. This directory is never published or signed. This is the only path the commit changes. This is the write_index() call at meta/lib/oe/package_manager/ipk/rootfs.py:281 Or are you saying that there is a use-case where e.g. core-image-minimal/1.0/oe-rootfs-repo gets published over the network, rather than build/tmp/deploy/ipk? I was referring to yocto_docs where the example given is publishing packages from tmp/deploy: $ cd bitbake-builds/build/tmp/deploy/rpm $ python3 -m http.server Étienne On Thu, Jul 30, 2026 at 1:51 PM Paul Barker <[email protected]> wrote: > On Thu, 2026-07-30 at 11:10 +0200, Etienne Cordonnier via > lists.openembedded.org wrote: > > From: Etienne Cordonnier <[email protected]> > > > > Computing checksums in the opkg Packages index requires reading every > > .ipk file in full. For a large image with 7000+ packages (including > > multi-gigabyte debug packages), this adds 150-300s to every do_rootfs > run. > > > > Checksums in the Packages index are only meaningful for signed feeds > > (PACKAGE_FEED_SIGN=1): the GPG signature covers the Packages index > > which contains the SHA256Sum of each .ipk, forming a chain of trust > > that prevents tampered packages being swapped on a remote feed. > > > > For unsigned local file:// feeds the packages are installed directly > > from the build host filesystem where there is no tampering risk. Skip > > all checksum generation in that case by passing no --checksum flags to > > opkg-make-index (the tool's default behaviour when given no flags). > > Pass --force-checksum to opkg so it does not error on the absent > > checksum fields. > > > > On a test image with 7000+ packages (including a 2.3 GB debug > > package): write_index time reduced from ~180s to ~22s (8x speedup) > > when opkg-make-index is configured to produce no checksums by default. > > > > See > https://git.openembedded.org/openembedded-core/commit/?id=e462f47489f35902b6972f9837d9adfa542fc796 > > ("Enable sha256 checksums in opkg indexer", 2019) for the original > rationale. > > > > AI-Generated: Claude Sonnet 4.6 > > Signed-off-by: Etienne Cordonnier <[email protected]> > > Hi, > > The package feed may be made available over a network and/or externally > signed after it has been generated, so I don't think we should disable > writing checksums into the feed by default. > > How about adding a variable to control this? It can be enabled by > default in OE-core and you can disable it in a local or distro config if > you know the signatures won't be needed in your use case. > > Best regards, > > -- > Paul Barker > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242348): https://lists.openembedded.org/g/openembedded-core/message/242348 Mute This Topic: https://lists.openembedded.org/mt/120516145/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
