build: only check hashes that are present
What the developer wrote
Authored by Jon Griffiths
build: only check hashes that are present
What changed, and why it matters
This is a small fix to a release verification script. Previously, the script would try to compare a firmware file against its expected hash even when the hash file was missing, which could cause the script to crash or behave unpredictably. Now it only performs the comparison when the hash file actually exists. This is a build/release hygiene improvement rather than a fix for an active security vulnerability in the device itself.
No urgent action required. Treat as routine build-script maintenance. Review release pipeline to ensure missing hash files are investigated rather than silently skipped.
Security signals we found
build/release script hardening
prevents verification script failure on missing artifact
does not alter firmware signing or hash algorithm
Evidence from the diff
The shell script release/scripts/checkfwsvr.sh validates firmware files against stored hashes. The original code logged a missing hash, then unconditionally computed and compared the firmware hash, which would fail if the .hash file was absent (e.g., cat of missing file, empty comparison). The patch moves the hash computation and comparison into an else branch so it only runs when the hash file is present. This prevents false failures and makes the missing-hash reporting accurate, but it does not change the fundamental trust model or cryptographic verification.
Changed components
release/scripts/checkfwsvr.shInspect captured patch +6 / −5
diff --git a/release/scripts/checkfwsvr.sh b/release/scripts/checkfwsvr.sh
index acb9612..f53bcf3 100755
--- a/release/scripts/checkfwsvr.sh
+++ b/release/scripts/checkfwsvr.sh
@@ -66,11 +66,12 @@ for hwdir in ${HWDIRS}; do
*_fw.bin)
if [ ! -f "${fw_file}.hash" ]; then
echo "Missing hash for ${fw_file}" >> "${MISSING_LOG}"
- fi
- fw_hash=$(get_uncompressed_hash "${fw_file}")
- if [ "${fw_hash}" != $(cat "${fw_file}.hash") ]; then
- echo "ERROR: Hash mismatch for ${fw_file}!"
- exit 1
+ else
+ fw_hash=$(get_uncompressed_hash "${fw_file}")
+ if [ "${fw_hash}" != $(cat "${fw_file}.hash") ]; then
+ echo "ERROR: Hash mismatch for ${fw_file}!"
+ exit 1
+ fi
fi
;;
esac
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.