cake_wallet icon indicating copy to clipboard operation
cake_wallet copied to clipboard

Upgrade versions of deps

Open emanuelb opened this issue 3 years ago • 3 comments

Currently wget used to download below files, which add the wget dependency that might be avoided if curl is used instead (curl is already a required dependency as it's used by flutter) also the below downloads have problems:

  1. not verified with hash checksum such as using sha256sum -c in order to check the checksum after downloading.
  2. old versions are downloaded.

List of downloads:

  1. https://github.com/cake-tech/cake_wallet/blob/3d3ece552362a254e68e56f9d70d6e60c4c6cd0a/scripts/android/install_ndk.sh#L12
  2. https://github.com/cake-tech/cake_wallet/blob/3d3ece552362a254e68e56f9d70d6e60c4c6cd0a/scripts/android/init_boost.sh#L11
  3. https://github.com/cake-tech/cake_wallet/blob/3d3ece552362a254e68e56f9d70d6e60c4c6cd0a/scripts/android/build_iconv.sh#L8
  4. https://github.com/cake-tech/cake_wallet/blob/3d3ece552362a254e68e56f9d70d6e60c4c6cd0a/scripts/android/build_openssl.sh#L13
  5. https://github.com/cake-tech/cake_wallet/blob/3d3ece552362a254e68e56f9d70d6e60c4c6cd0a/scripts/android/build_openssl.sh#L19

Newest versions are:

  1. r22b instead of r17c for android ndk, download link: download link: https://dl.google.com/android/repository/android-ndk-r22b-linux-x86_64.zip From: https://developer.android.com/ndk/downloads/#stable-downloads
  2. boost 1.76.0 instead of 1.68.0: https://dl.bintray.com/boostorg/release/1.76.0/source/boost_1_76_0.tar.bz2
  3. libiconv-1.16 instead of libiconv-1.15: download link: https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.16.tar.gz
  4. openssl-1.1.1k instead of openssl-1.0.2p: From: https://www.openssl.org/source/

All older versions (including 1.1.0, 1.0.2, 1.0.0 and 0.9.8) are now out of support and should not be used. Users of these older versions are encouraged to upgrade to 1.1.1 as soon as possible.

download link: https://www.openssl.org/source/openssl-1.1.1k.tar.gz

To fix:

  1. change wget invocation to curl (-O should be changed to -o):
  2. upgrade the links to download newer versions of the tools.
  3. add sha256sum -c calls after downloading the files to verify checksum. Add the checksum after verification of the downloaded file with GPG if available, such as the following files: https://dl.bintray.com/boostorg/release/1.76.0/source/boost_1_76_0.tar.bz2.asc https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.16.tar.gz.sig https://www.openssl.org/source/openssl-1.1.1k.tar.gz.asc https://zlib.net/zlib-1.2.11.tar.gz.asc

emanuelb avatar May 01 '21 20:05 emanuelb

Will work on that after 4.2.0 release.

mkyq avatar May 10 '21 12:05 mkyq

Unfortunately we cannot to implement all of that updates, because we already spent few nights to try to update to newest version which you provided and found few cross version conflicts (some libraries cannot to be compiled with newest of above). But we will upgrade most of them and will update build instruction soon.

mkyq avatar Aug 18 '21 14:08 mkyq

fixed:

  1. all wget commands are changed to curl
  2. sha256sum used for checksum checking of downloads.

need to be fixed is upgrade components:

  1. boost 1.79.0 instead of 1.72.0: https://github.com/cake-tech/cake_wallet/blob/3ecb37877e830e1129434a648ff1782eec8c30e9/scripts/android/build_boost.sh#L6 https://www.boost.org/users/download/
  2. zlib v1.2.12 instead of v1.2.11 https://github.com/cake-tech/cake_wallet/blob/09db6151e47ee0f4f9a1f1b7488b19fbfee7fdae/scripts/android/build_openssl.sh#L11 https://github.com/madler/zlib/tags
  3. openssl-1.1.1n or openssl-3.0.2 instead of openssl-1.1.1k: https://github.com/cake-tech/cake_wallet/blob/09db6151e47ee0f4f9a1f1b7488b19fbfee7fdae/scripts/android/build_openssl.sh#L6 https://www.openssl.org/source/
  4. r23b or r24 instead of r17c: https://github.com/cake-tech/cake_wallet/blob/373fa66433da031ffd67a148eb97a69a73733019/scripts/android/install_ndk.sh#L11

emanuelb avatar Apr 13 '22 23:04 emanuelb