build: migrate tarball integrity checksums from sha1 to sha512

Replace the per-tarball sha1 integrity pins with sha512 (upstream asked
for sha512 rather than sha256).

  - fetch-package: verify ${FILE}.sha512 with sha512sum (was sha1sum /
    .sha1); the second argument is now the SHA512 directory.
  - crosstool-ng.make: update the "how to pin a new package" comment to
    sha512sum / .sha512.
  - Convert every active upstream/*.sha1 to upstream/*.sha512 (hashes
    computed from the verified tarballs) and drop all now-unused .sha1
    pins for versions no longer referenced.

Every checksum was generated from a tarball first verified against its
previous sha1 pin, so the sha512 values correspond to exactly the bytes
ONIE already trusted.

Note: this also pins acpica-unix-20260408, libpcap-1.10.6 and
tcpdump-4.99.6, whose current-version checksums would otherwise be
absent.

Signed-off-by: Brad House <bhouse@nexthop.ai>

Author: bhouse-nexthop

build-config/make/crosstool-ng.make

@@ -13,8 +13,8 @@
 
 # Default GCC version to build for the toolchain.
 #  Tip: Reference a Debian install for related component versions.
-#  To upgrade sha1 for new package:
-#     sha1sum ./gcc-8.3.0.tar.xz > ./upstream/gcc-8.3.0.tar.xz.sha1
+#  To upgrade the sha512 pin for a new package:
+#     sha512sum ./gcc-8.3.0.tar.xz > ./upstream/gcc-8.3.0.tar.xz.sha512
 #     https://ftp.gnu.org/pub/gnu/gcc/gcc-8.3.0/gcc-8.3.0.tar.xz
 GCC_VERSION 			?= 14.3.0
 

build-config/scripts/fetch-package

@@ -12,14 +12,14 @@
 usage() {
     cat <<EOF
 $0: Usage
-$0 <download dir> <SHA1 dir> <base file name> <URL1> [[URL2] .. [URLx]]
+$0 <download dir> <SHA512 dir> <base file name> <URL1> [[URL2] .. [URLx]]
 
 Download file into download directory using the list of base URLs.
 For example the following URL is attempted:
 
    \$URL1/\$base_file_name
 
-The <SHA1 dir> contains <base file name>.sha1, which is verified
+The <SHA512 dir> contains <base file name>.sha512, which is verified
 after downloading.
 EOF
 }
@@ -35,7 +35,7 @@ EOF
 DOWNLOAD_CACHE_DIR="/var/cache/onie/download"
 
 OUTDIR=$1
-SHA1DIR=$2
+SHA512DIR=$2
 FILE=$3
 
 shift 3
@@ -46,8 +46,8 @@ shift 3
     exit 1
 }
 
-[ -d "$SHA1DIR" ] || {
-    echo "Error: SHA1 directory does not exist: $SHA1DIR"
+[ -d "$SHA512DIR" ] || {
+    echo "Error: SHA512 directory does not exist: $SHA512DIR"
     usage
     exit 1
 }
@@ -109,9 +109,9 @@ else
     echo ""
 fi
 
-# Verify SHA1
-cd $OUTDIR && sha1sum -c ${SHA1DIR}/${FILE}.sha1 || {
-        echo " ERROR: Unable to verify sha1 for ${FILE}"
+# Verify SHA512
+cd $OUTDIR && sha512sum -c ${SHA512DIR}/${FILE}.sha512 || {
+        echo " ERROR: Unable to verify sha512 for ${FILE}"
         exit 1
     }
 

upstream/0.3.0.tar.gz.sha1

@@ -0,0 +1 @@
+cdab37f86191c009b8264f065c3ca8ca051d8c1366191dca4c142d4146a0f7b7614cb17e53b6a8ca6fde0462bc113d4a1a751673b755eea0b3ed6e90da507f5a  0.7.2.tar.gz

upstream/0.7.2.tar.gz.sha1

@@ -0,0 +1 @@
+04e40a705cb82440fd823043b598ef9fd1acc2ceda3e8d043a93e49d43ea9481b7386cad0f46de9862beff19b8a5480d79e7d6522ae584aff6655472f967764d  18.tar.gz

upstream/0.7.2.tar.gz.sha512

@@ -0,0 +1 @@
+04493c30efbfc2773abac9a3dd93aa13403c05e29e3bfc72877d2054930811fae99119aadcb1729b6ca85abf5a24db786ea0c27c16d5458ef1b19e74696f5ff7  39.tar.gz