Verify SHA of downloaded net file

check SHA of the available and downloaded file.

Document the format requirement on the default net.

Also allow curl to make possibly insecure connections, as needed for old curl.

fixes https://github.com/official-stockfish/Stockfish/issues/2998

closes https://github.com/official-stockfish/Stockfish/pull/3000

No functional change.

diff --git a/src/Makefile b/src/Makefile
index a9fb7b817da0eaae7092b4fe2d3084f13a03b399..38f607cb24f58fdc2719197be82b82be87e01b04 100644 (file)
--- a/src/Makefile
+++ b/src/Makefile
@@ -624,8 +624,10 @@ net:
        $(eval nnuenet := $(shell grep EvalFile ucioption.cpp | grep Option | sed 's/.*\(nn-[a-z0-9]\{12\}.nnue\).*/\1/'))
        @echo "Default net: $(nnuenet)"
        $(eval nnuedownloadurl := https://tests.stockfishchess.org/api/nn/$(nnuenet))
        $(eval nnuenet := $(shell grep EvalFile ucioption.cpp | grep Option | sed 's/.*\(nn-[a-z0-9]\{12\}.nnue\).*/\1/'))
        @echo "Default net: $(nnuenet)"
        $(eval nnuedownloadurl := https://tests.stockfishchess.org/api/nn/$(nnuenet))

-       $(eval curl_or_wget := $(shell if hash curl 2>/dev/null; then echo "curl -sL"; elif hash wget 2>/dev/null; then echo "wget -qO-"; fi))
+       $(eval curl_or_wget := $(shell if hash curl 2>/dev/null; then echo "curl -skL"; elif hash wget 2>/dev/null; then echo "wget -qO-"; fi))

        @if test -f "$(nnuenet)"; then echo "Already available."; else echo "Downloading $(nnuedownloadurl)"; $(curl_or_wget) $(nnuedownloadurl) > $(nnuenet); fi
        @if test -f "$(nnuenet)"; then echo "Already available."; else echo "Downloading $(nnuedownloadurl)"; $(curl_or_wget) $(nnuedownloadurl) > $(nnuenet); fi

+       $(eval shasum_command := $(shell if hash shasum 2>/dev/null; then echo "shasum -a 256 "; elif hash sha256sum 2>/dev/null; then echo "sha256sum "; fi))
+       @if [ "$(nnuenet)" != "nn-"`$(shasum_command) $(nnuenet) | cut -c1-12`".nnue" ]; then echo "Failed download or $(nnuenet) corrupted, please delete!"; exit 1; fi

 
 # clean binaries and objects
 objclean:
 
 # clean binaries and objects
 objclean:

diff --git a/src/ucioption.cpp b/src/ucioption.cpp
index 0a35d01bbf0c6d078065f82f6b0cb0f673844282..2b66a47545a5644a7bc97bf43ebdbd91032a5e6c 100644 (file)
--- a/src/ucioption.cpp
+++ b/src/ucioption.cpp
@@ -79,6 +79,8 @@ void init(OptionsMap& o) {
   o["Syzygy50MoveRule"]      << Option(true);
   o["SyzygyProbeLimit"]      << Option(7, 0, 7);
   o["Use NNUE"]              << Option(false, on_use_NNUE);
   o["Syzygy50MoveRule"]      << Option(true);
   o["SyzygyProbeLimit"]      << Option(7, 0, 7);
   o["Use NNUE"]              << Option(false, on_use_NNUE);

+  // The default must follow the format nn-[SHA256 first 12 digits].nnue
+  // for the build process (profile-build and fishtest) to work.

   o["EvalFile"]              << Option("nn-82215d0fd0df.nnue", on_eval_file);
 }
 
   o["EvalFile"]              << Option("nn-82215d0fd0df.nnue", on_eval_file);
 }