dropbear-openipc: hash file is named dropbear.hash, so Buildroot never verifies the tarball

[openipc-ai]

general/package/dropbear-openipc/ ships its checksums as dropbear.hash, named after the upstream project. Buildroot looks for <RAWNAME>.hash, where RAWNAME is the package name — so for this package it wants dropbear-openipc.hash, and the file we ship is never opened.

package/pkg-generic.mk:512 builds the list, and Buildroot will tell you itself:

$ make -C output/buildroot-2024.02.10 BR2_EXTERNAL=$PWD/general O=$PWD/output \
       printvars VARS="DROPBEAR_OPENIPC_HASH_FILES DROPBEAR_OPENIPC_RAWNAME"

DROPBEAR_OPENIPC_HASH_FILES=general/package/dropbear-openipc//dropbear-openipc.hash \
                            general/package/all-patches/dropbear-openipc/dropbear-openipc.hash
DROPBEAR_OPENIPC_RAWNAME=dropbear-openipc

Neither of those paths exists. For contrast, upstream's own package resolves to package/wpa_supplicant//wpa_supplicant.hash, which does.

Why it matters

support/download/check-hash prints WARNING: no hash file for dropbear-2022.82.tar.bz2 and returns success, and we do not set BR2_DOWNLOAD_FORCE_CHECK_HASHES — it is not set in the generated .config. So the tarball is fetched and built with no integrity check at all and the build stays green. DROPBEAR_OPENIPC_SITE is http://sources.buildroot.net/dropbear, over plain HTTP, and dropbear is the SSH daemon on every image that enables it.

The LICENSE hashes in the same file are equally dead, so legal-info loses its check too.

This is not a theoretical concern about the mirror. The point is that we ship a file whose entire purpose is verification, it looks correct in review, and it does nothing.

Fix

git mv general/package/dropbear-openipc/dropbear.hash \
       general/package/dropbear-openipc/dropbear-openipc.hash

Nothing in the file's contents needs to change. Confirm afterwards with the printvars command above, or by clearing the dl cache for the package and watching the WARNING: line disappear.

Scope

I checked every .hash in the tree. Only this one is misnamed:

package	hash file	read?
libjpeg-openipc	libjpeg-openipc.hash	yes
webrtc-audio-processing-openipc	webrtc-audio-processing-openipc.hash	yes
legacy/gst1-plugins-bad-openipc	gst1-plugins-bad-openipc.hash	yes
dropbear-openipc	dropbear.hash	no

Found while reviewing #2449, which introduced a second instance of the same mistake (wpa_supplicant.hash in a package directory named wpa_supplicant-openipc); that one is being fixed on the PR. Worth knowing the trap exists when forking an upstream Buildroot package: the -openipc suffix has to reach the hash file too, the same way it reaches the symbol and variable prefixes.