[aur-general] Support for remote sums in PKGBUILDs

[Doug Newgard]

----------------------------------------
> From: adys.wh at gmail.com
> Date: Tue, 22 Oct 2013 01:56:16 +0100
> To: aur-general at archlinux.org
> Subject: [aur-general] Support for remote sums in PKGBUILDs
>
> Breaking away from an IRC convo from this morning; has support for
> remote sums been considered for pacman?
> It's currently possible to do this for .sig files (through the source
> array), but not available for simple sha/md5 hashes. This would let
> packagers do something like:
> source=("http://example.com/downloads/$pkgname-$pkgver.tar.xz")
> sha1sums=("http://example.com/downloads/$pkgname-$pkgver.tar.xz.sha1")
>
> (Of course, only for servers that generate a programmatically
> discoverable hash of some sort; but it's not actually uncommon)
>
> J. Leclanche

Couldn't you just do:
sha1sums=("$(curl http://example.com/downloads/$pkgname-$pkgver.tar.xz.sha1)")

It kind of defeats the purpose, though. If the server is hacked or someone does a MitM, they can easily replace the checksum file as well.