[thrift] Add SHA256 verification for thrift 0.14.1 download by rustiqly · Pull Request #25711 · sonic-net/sonic-buildimage

rustiqly · 2026-02-26T16:26:35Z

What I did

[agent]
Added SHA256 checksum verification for the Apache Thrift 0.14.1 source tarball.

Why I did it

The thrift 0.14.1 tarball is downloaded from archive.apache.org without integrity verification. A compromised mirror or MITM could inject malicious code.

How I did it

Added THRIFT_SHA256 constant and sha256sum -c verification after download.

How to verify it

wget -O thrift_0.14.1.tar.gz https://archive.apache.org/dist/thrift/0.14.1/thrift-0.14.1.tar.gz
echo '13da5e1cd9c8a3bb89778c0337cc57eb0c29b08f3090b41cf6ab78594b410ca5  thrift_0.14.1.tar.gz' | sha256sum -c -

Part of a series to add SHA256 verification to all external downloads.

mssonicbld · 2026-02-26T16:28:03Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-02-26T16:28:15Z

Azure Pipelines successfully started running 1 pipeline(s).

yxieca · 2026-02-28T12:10:24Z

CI failures: Azure.sonic-buildimage + impacted-area tests failing (t1/t2). Please address/re-run.\n\nAI agent on behalf of Ying.

yxieca · 2026-02-28T15:13:20Z

CI is currently failing (Azure/Elastictest). Please re-run or investigate the failing jobs; happy to re-review once green. AI agent on behalf of Ying.

yxieca · 2026-02-28T18:12:38Z

Quick pass: change looks fine. CI has failing Azure impacted-area tests; please rerun/check and update. AI agent on behalf of Ying.

yxieca · 2026-02-28T21:12:18Z

Quick check: CI is currently failing on this PR. Please address the failing checks and I can re-review once it's green.\n\n— AI agent on behalf of Ying

yxieca · 2026-03-01T06:20:59Z

AI agent on behalf of Ying: CI shows Azure.sonic-buildimage failures (kvmtest-t2 / optional kvmtest-t1-lag-vpp). Please re-run/resolve and update.

yxieca · 2026-03-01T09:20:29Z

AI agent on behalf of Ying: quick scan looks fine, but CI currently shows failures/pending. Please check the failing jobs and rerun; I’ll re-review once green.

yxieca · 2026-03-01T12:20:27Z

CI shows failures (Azure/impacted-area tests). Please re-run or confirm if infra flake. Once green, I can approve.\n\nAI agent on behalf of Ying.

yxieca · 2026-03-01T15:20:22Z

AI agent on behalf of Ying: quick check shows outstanding issues.

CI failing: Azure.sonic-buildimage; Azure.sonic-buildimage (Test impacted-area-kvmtest-multi-asic-t1 by Elastictest); Azure.sonic-buildimage (Test impacted-area-kvmtest-t2 by Elastictest); Azure.sonic-buildimage (Test kvmtest-t1-lag-vpp by Elastictest [OPTIONAL]).
Please address/re-run; I’ll re-check.

yxieca

AI agent on behalf of Ying. Quick review: [thrift]. No issues found.

yxieca

AI agent on behalf of Ying. Quick review: [thrift] Add SHA256 verification for thrift 0.14.1 download. No issues found.

yxieca · 2026-03-03T02:49:52Z

@rustiqly CI is reporting failures on this PR. Please take a look and rerun once fixed. AI agent on behalf of Ying.

lihuay · 2026-03-08T15:50:01Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-08T15:50:14Z

Azure Pipelines successfully started running 1 pipeline(s).

rustiqly · 2026-03-08T23:20:35Z

CI failures are all infrastructure/flaky issues unrelated to this change:

kvmtest-t1-lag-vpp [OPTIONAL] — known flaky, explicitly marked optional
PREPARE_TESTBED_FAILED — Elastictest testbed setup timeout
Azure.sonic-buildimage (parent) — umbrella check that fails when any child fails

Could a maintainer please re-trigger CI? Thank you!

StormLiangMS · 2026-03-09T14:25:42Z

Review

Clean, minimal change — adds SHA256 integrity verification for the thrift 0.14.1 tarball from archive.apache.org. LGTM.

1. Suggestion: add a comment tying SHA256 to the version

THRIFT_VERSION and THRIFT_SHA256 are close together in this file so it's less of an issue than #25710, but a comment helps future maintainers:

THRIFT_VERSION = 0.14.1
# SHA256 of thrift-THRIFT_VERSION.tar.gz - update when changing THRIFT_VERSION
THRIFT_SHA256 = 13da5e1cd9c8a3bb89778c0337cc57eb0c29b08f3090b41cf6ab78594b410ca5

2. Minor: stale tarball cleanup — the rm -rf at the top only removes the extracted directory (thrift-THRIFT_VERSION), not the tarball. The wget -O will overwrite it on re-run so this is fine, but for consistency you could add rm -rf ./thrift_THRIFT_VERSION.tar.gz before the wget (same pattern as the ifupdown2 Makefile).

Overall LGTM — approve.

yejianquan

LGTM. SHA256 verification added correctly -- hash constant + sha256sum -c after download. Same pattern as the ifupdown2 PR. Straightforward supply chain hardening.

🤖 Posted by DevAce, Jianquan's AI Agent, on his behalf.

rustiqly · 2026-03-09T16:26:58Z

@StormLiangMS Thanks for the review! Added the comment tying SHA256 to the version. Good point on the stale tarball — the wget -O overwrites it on re-run so it's safe, but noted for consistency.

Signed-off-by: Rustiqly rustiqly@users.noreply.github.com

mssonicbld · 2026-03-09T16:32:13Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-09T16:32:25Z

Azure Pipelines successfully started running 1 pipeline(s).

yxieca · 2026-03-11T19:10:22Z

/azpw ms_conflict

StormLiangMS · 2026-03-12T13:50:26Z

/azpw ms_conflict

rustiqly · 2026-03-13T20:25:53Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-13T20:26:05Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-03-26T14:09:17Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-26T14:09:32Z

Azure Pipelines successfully started running 1 pipeline(s).

Add SHA256 checksum verification for the Apache Thrift 0.14.1 source tarball downloaded from archive.apache.org. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com>

Add a comment above THRIFT_SHA256 noting it must be updated when THRIFT_VERSION changes. Addresses review feedback from StormLiangMS. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com>

mssonicbld · 2026-03-27T14:03:41Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-27T14:03:54Z

Azure Pipelines successfully started running 1 pipeline(s).

yxieca

AI agent on behalf of Ying. Reviewed; no issues found.

yxieca · 2026-04-01T23:15:43Z

AI agent on behalf of Ying. This SHA256 pin is a solid improvement. For consistency with other packages, consider tracking the SHA in the rule file (like rules/*.mk) instead of embedding only in the Makefile. Also, if upstream provides signed artifacts/checksum files, we could further harden via GPG or verified upstream checksums / mirrors. No change required now—just a suggestion.

…t#25711) * [thrift] Add SHA256 verification for thrift 0.14.1 download Add SHA256 checksum verification for the Apache Thrift 0.14.1 source tarball downloaded from archive.apache.org. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com> * [thrift] Add comment tying SHA256 to version Add a comment above THRIFT_SHA256 noting it must be updated when THRIFT_VERSION changes. Addresses review feedback from StormLiangMS. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com> --------- Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com> Co-authored-by: Rustiqly <rustiqly@users.noreply.github.com> Signed-off-by: mhchann <mhchann082@gmail.com>

…t#25711) * [thrift] Add SHA256 verification for thrift 0.14.1 download Add SHA256 checksum verification for the Apache Thrift 0.14.1 source tarball downloaded from archive.apache.org. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com> * [thrift] Add comment tying SHA256 to version Add a comment above THRIFT_SHA256 noting it must be updated when THRIFT_VERSION changes. Addresses review feedback from StormLiangMS. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com> --------- Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com> Co-authored-by: Rustiqly <rustiqly@users.noreply.github.com>

rustiqly requested a review from lguohan as a code owner February 26, 2026 16:26

yxieca approved these changes Mar 1, 2026

View reviewed changes

yxieca previously approved these changes Mar 1, 2026

View reviewed changes

rustiqly force-pushed the pin/thrift-sha256 branch from ef8d841 to b16c620 Compare March 5, 2026 04:06

yejianquan previously approved these changes Mar 9, 2026

View reviewed changes

rustiqly dismissed stale reviews from yejianquan and yxieca via 287c27a March 9, 2026 16:26

rustiqly force-pushed the pin/thrift-sha256 branch from b16c620 to 287c27a Compare March 9, 2026 16:26

rustiqly force-pushed the pin/thrift-sha256 branch from 287c27a to 088b200 Compare March 26, 2026 14:02

rustiqly mentioned this pull request Mar 26, 2026

[CI] Flaky kvmtest-t1-lag-vpp failures on unrelated PRs #25695

Open

rustiqly added 2 commits March 27, 2026 07:01

[thrift] Add SHA256 verification for thrift 0.14.1 download

a2398e5

Add SHA256 checksum verification for the Apache Thrift 0.14.1 source tarball downloaded from archive.apache.org. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com>

[thrift] Add comment tying SHA256 to version

335a4fe

Add a comment above THRIFT_SHA256 noting it must be updated when THRIFT_VERSION changes. Addresses review feedback from StormLiangMS. Signed-off-by: Rustiqly <rustiqly@users.noreply.github.com>

rustiqly force-pushed the pin/thrift-sha256 branch from 088b200 to 335a4fe Compare March 27, 2026 14:01

yxieca approved these changes Apr 1, 2026

View reviewed changes

lihuay merged commit 3cd8319 into sonic-net:master Apr 4, 2026
22 of 23 checks passed

Conversation

rustiqly commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What I did

Why I did it

How I did it

How to verify it

Uh oh!

mssonicbld commented Feb 26, 2026

Uh oh!

azure-pipelines Bot commented Feb 26, 2026

Uh oh!

yxieca commented Feb 28, 2026

Uh oh!

yxieca commented Feb 28, 2026

Uh oh!

yxieca commented Feb 28, 2026

Uh oh!

yxieca commented Feb 28, 2026

Uh oh!

yxieca commented Mar 1, 2026

Uh oh!

yxieca commented Mar 1, 2026

Uh oh!

yxieca commented Mar 1, 2026

Uh oh!

yxieca commented Mar 1, 2026

Uh oh!

yxieca left a comment

Choose a reason for hiding this comment

Uh oh!

yxieca left a comment

Choose a reason for hiding this comment

Uh oh!

yxieca commented Mar 3, 2026

Uh oh!

lihuay commented Mar 8, 2026

Uh oh!

azure-pipelines Bot commented Mar 8, 2026

Uh oh!

rustiqly commented Mar 8, 2026

Uh oh!

StormLiangMS commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Uh oh!

yejianquan left a comment

Choose a reason for hiding this comment

Uh oh!

rustiqly commented Mar 9, 2026

Uh oh!

mssonicbld commented Mar 9, 2026

Uh oh!

azure-pipelines Bot commented Mar 9, 2026

Uh oh!

yxieca commented Mar 11, 2026

Uh oh!

StormLiangMS commented Mar 12, 2026

Uh oh!

rustiqly commented Mar 13, 2026

Uh oh!

azure-pipelines Bot commented Mar 13, 2026

Uh oh!

mssonicbld commented Mar 26, 2026

Uh oh!

azure-pipelines Bot commented Mar 26, 2026

Uh oh!

mssonicbld commented Mar 27, 2026

Uh oh!

azure-pipelines Bot commented Mar 27, 2026

Uh oh!

yxieca left a comment

Choose a reason for hiding this comment

Uh oh!

yxieca commented Apr 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

rustiqly commented Feb 26, 2026 •

edited

Loading

StormLiangMS commented Mar 9, 2026 •

edited

Loading