[ARROW-13787] [C++] Verify third-party downloads

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 5.0.0
• Fix Version/s: 6.0.0
• Component/s: C++
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/29414
• Assignee: Karl Dunkle Werner
• Reporter: Karl Dunkle Werner
• Created: 27/Aug/21 19:44
• Updated: 11/Jan/23 08:35
• Resolved: 28/Aug/21 20:58

Description

I think it might be helpful to have cmake use an SHA256 hash to verify the third-party files it downloads. I can submit a PR for this.

Upsides:

• Downloads are further verified for integrity (in addition to the verification from https)
• cmake stops complaining about missing verification (when ARROW_VERBOSE_THIRDPARTY_BUILD=ON)

Downside:

• Slightly more work in the future to add or update a third-party dependency.

The cmake docs note:

Specifying [URL_HASH] is strongly recommended for URL downloads, as it ensures the integrity of the downloaded content. It is also used as a check for a previously downloaded file, allowing connection to the remote location to be avoided altogether if the local directory already has a file from an earlier download that matches the specified hash.

SHA256 was introduced in cmake 2.8.7, released in late 2011.

Issue Links

• links to: GitHub Pull Request #11021