dev-manual: Modified how to find checksums in the recipes

The section on wrting a new recipe suggested using a "build-fail"
method to get bitbake to return exact checksums for code.  It
was pointed out that this could be a middle-security risk and
that we should not do that but instead get the signatures from
the upstream website.  However, many times those sites don't
provide that information.  I re-worded the text to note the
ideal method (upstream checksums) and then resorted to the
"build-fail" method as a "way" to also get them when the upstream
location does not have them.

(From yocto-docs rev: b06699de2f512b01600bf952a8ee928c2a4c358a)

Signed-off-by: Scott Rifenbark <scott.m.rifenbark@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

1 files changed, 6 insertions, 1 deletions

diff --git a/documentation/dev-manual/dev-manual-common-tasks.xml b/documentation/dev-manual/dev-manual-common-tasks.xml
index d235a99f91..8f7c6d9269 100644
--- a/documentation/dev-manual/dev-manual-common-tasks.xml
+++ b/documentation/dev-manual/dev-manual-common-tasks.xml
@@ -1789,7 +1789,12 @@
             </para>
 
             <para>
-                To find these checksums, you can comment the statements out
+                Ideally, you should locate these checksums from the upstream
+                website and use them in your recipe.
+                However, many websites do not provide the checksums.
+                If such is the case, you can use a "build-fail" method that
+                retrieves the exact strings you need.
+                To use the "build-fail" method, comment the statements out
                 and then attempt to build the software.
                 The build will produce an error for each missing checksum
                 and as part of the error message provide the correct checksum