disable verify for package

4 files changed, 25 insertions, 9 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 683e10e1c..3b7b1de3d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 * Add new [xrepo](https://github.com/xmake-io/xrepo) command to manage C/C++ packages
 * Support for installing packages of cross-compilation
 * Add musl.cc toolchains
+* [#1009](https://github.com/xmake-io/xmake/issues/1009): Support select and install any version package, e.g. `add_requires("libcurl 7.73.0", {verify = false})`
 
 ### Change
 
@@ -860,6 +861,7 @@
 * 添加新的 [xrepo](https://github.com/xmake-io/xrepo) 命令去管理安装 C/C++ 包
 * 支持安装交叉编译的依赖包
 * 新增musl.cc上的工具链支持
+* [#1009](https://github.com/xmake-io/xmake/issues/1009): 支持忽略校验去安装任意版本的包，`add_requires("libcurl 7.73.0", {verify = false})`
 
 ### 改进
 
diff --git a/xmake/actions/require/impl/actions/download.lua b/xmake/actions/require/impl/actions/download.lua
index 57f28989f..95920af06 100644
--- a/xmake/actions/require/impl/actions/download.lua
+++ b/xmake/actions/require/impl/actions/download.lua
@@ -94,12 +94,13 @@ function _download(package, url, sourcedir, url_alias, url_excludes)
     --
     -- we need not sourcehash and skip checksum to try download it directly if no version list in package()
     -- @see https://github.com/xmake-io/xmake/issues/930
+    -- https://github.com/xmake-io/xmake/issues/1009
     --
     local sourcehash = package:sourcehash(url_alias)
     if sourcehash then
         sourcehash = sourcehash:lower()
     end
-    assert(not package:get("versions") or sourcehash, "cannot get source hash of %s in package(%s)", url, package:name())
+    assert(not package:verify() or not package:get("versions") or sourcehash, "cannot get source hash of %s in package(%s)", url, package:name())
 
     -- the package file have been downloaded?
     local cached = true
@@ -158,7 +159,7 @@ function _urls(package)
     for _, url in ipairs(package:urls()) do
         if git.checkurl(url) then
             table.insert(urls[1], url)
-        elseif not package:get("versions") or package:sourcehash(package:url_alias(url)) then
+        elseif not package:verify() or not package:get("versions") or package:sourcehash(package:url_alias(url)) then
             table.insert(urls[2], url)
         end
     end
diff --git a/xmake/actions/require/impl/package.lua b/xmake/actions/require/impl/package.lua
index 8f39be47a..ed89cf54f 100644
--- a/xmake/actions/require/impl/package.lua
+++ b/xmake/actions/require/impl/package.lua
@@ -167,7 +167,8 @@ function _parse_require(require_str, requires_extra, parentinfo)
         option           = require_extra.option,    -- set and attach option
         configs          = require_build_configs,   -- the required building configurations
         default          = require_extra.default,   -- default: true, we can set it to disable package manually
-        optional         = parentinfo.optional or require_extra.optional -- default: false, inherit parentinfo.optional
+        optional         = parentinfo.optional or require_extra.optional, -- default: false, inherit parentinfo.optional
+        verify           = require_extra.verify     -- default: true, we can set false to ignore sha256sum and select any version
     }
 
     -- save this required item to cache
@@ -257,15 +258,17 @@ function _select_package_version(package, requireinfo)
         local source = nil
         local version = nil
         local require_version = requireinfo.version
-        if #package:versions() > 0 and (require_version == "latest" or require_version:find('.', 1, true)) then -- select version?
-            version, source = semver.select(require_version, package:versions())
-        elseif has_giturl then -- select branch?
-            version, source = require_version ~= "latest" and require_version or "master", "branches"
-        elseif not package:get("versions") and semver.is_valid(require_version) then
-            -- no version list in package()? try this version directly
+        local require_verify  = requireinfo.verify
+        if (not package:get("versions") or require_verify == false) and semver.is_valid(require_version) then
+            -- no version list in package() or need not verify sha256sum? try selecting this version directly
             -- @see https://github.com/xmake-io/xmake/issues/930
+            -- https://github.com/xmake-io/xmake/issues/1009
             version = require_version
             source = "versions"
+        elseif #package:versions() > 0 and (require_version == "latest" or require_version:find('.', 1, true)) then -- select version?
+            version, source = semver.select(require_version, package:versions())
+        elseif has_giturl then -- select branch?
+            version, source = require_version ~= "latest" and require_version or "master", "branches"
         else
             raise("package(%s %s): not found!", package:name(), require_version)
         end
diff --git a/xmake/core/package/package.lua b/xmake/core/package/package.lua
index 463cebebc..934958ec4 100644
--- a/xmake/core/package/package.lua
+++ b/xmake/core/package/package.lua
@@ -729,6 +729,16 @@ function _instance:optional()
     return requireinfo and requireinfo.optional or false
 end
 
+-- verify sha256sum and versions?
+function _instance:verify()
+    local requireinfo = self:requireinfo()
+    local verify = requireinfo and requireinfo.verify
+    if verify == nil then
+        verify = true
+    end
+    return verify
+end
+
 -- is debug package?
 function _instance:debug()
     return self:config("debug")