[CMake] FetchContent/ExternalProject and URL_HASH

[Craig Scott]

On Wed, Jul 17, 2019 at 12:59 PM Dustyn Blasig <dustyn at blasig.us> wrote:

> Hi All,
>
> We are pulling some artifacts from Artifactory which provides a checksum
> file along with the artifacts at <artifact-url>.md5 or .sha256. If I do not
> include URL_HASH, does CMake automatically check to see if such a checksum
> file exists and use it's value for the hash check? Or is there a way to
> provide a URL for the checksum file rather than having to do file(DOWNLOAD
> <checksum>), file(STRING <checksum-file>), URL_HASH=<checksum-var>?
>

The point of the checksum file is to verify the file downloaded. It doesn't
make a whole lot of sense to then download another file to provide that
checksum, you'd just be moving the problem along one level of indirection.
The assumption is when you provide the URL to be downloaded, if you want to
use a checksum then you should also be able to provide that along with the
URL. When the URL is being constructed on-the-fly though, this isn't
typically true. In that case, you can't typically provide a checksum that
isn't itself downloaded and therefore needs to be verified itself.

To more directly answer your question, CMake doesn't offer any feature to
automatically download a checksum file (that I'm aware of). The file
command expects that actual checksum, not a location for where to retrieve
it from for the reasons mentioned above.

-- 
Craig Scott
Melbourne, Australia
https://crascit.com

Get the hand-book for every CMake user: Professional CMake: A Practical
Guide <https://crascit.com/professional-cmake/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://cmake.org/pipermail/cmake/attachments/20190721/e1187d77/attachment.html>