Re: pkg_info -X: Add FILE_CKSUM (sha256)

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

> Date: Sat, 17 Jan 2026 20:45:26 +0000
> From: Taylor R Campbell <campbell%mumble.net@localhost>
> 
> > Date: Sat, 17 Jan 2026 09:44:11 +0000 (UTC)
> > From: Benny Siegert <bsiegert%netbsd.org@localhost>
> > 
> > On Sat, 17 Jan 2026, Jonathan Perkin wrote:
> > 
> > > Not yet.  Taylor has an open PR for this, but I owe him a review (I don't 
> > > like making it an error for pkg_summary not to have checksums).
> > 
> > Makes sense. The behavior I would like to see (I think) is:
> > 
> > If there is a checksum line in the summary, check the sum and refuse to 
> > install the package if it does not match.
> > 
> > If there is no checksum line for the package in the summary, skip 
> > checking.
> 
> Here is what I proposed for pkgin:
> 
> https://github.com/NetBSDfr/pkgin/pull/141
> 
> > Refuse to download packages without hashes, unless the environment
> > variable PKGIN_ALLOW_UNHASHED is set.

I thought about it further and decided to remove this part.  With the
updated change to pkgin, if the pkg_summary file has SHA-256 hashes,
they will be checked; if it doesn't, then they won't be, as bsiegert
and jperkin both suggested.

This way, there is no behaviour change anywhere, unless the package
builder uses pkg_info -H sha256 to generate the summary, at which
point -- if the change is merged -- newer pkgin will automatically
start verifying the hashes as it downloads package files.