Re: tag2upload (git-debpush) service architecture - draft

[Bastian Blank <waldi@debian.org>]

On Sun, Jul 28, 2019 at 07:05:49PM +0100, Rebecca N. Palmer wrote:
> That suggests that working towards requiring the SHA-256 mode of git (which
> at least sort of exists since 2.21 [2], but I don't know if it's usable yet)
> might be a better use of effort.

Please keep in mind that the archive needs to verify this.  How do you
intend to provide the required information within the existing source
package structure?

> [1] needs reproducibility, but simpler than pristine-tar in that we're only
> trying to create _a_ reproducible tarball (not match one created by
> upstream) and don't need to compress it (as it can be deleted after hashing
> - unfortunately tar doesn't obviously have a write-to-stdout option to allow
> tar | sha256).  Reproducible builds suggests tar --sort=name --owner=0
> --group=0 --numeric-owner.

For now "git archive" with tar output seems to reproducible from jessie
(2.1.4) to sid (2.23 rc).

Another idea, however we would need to trust some decompressors:

The hypothetical tool creates a complete .dsc file with the names and
checksums of the uncompressed files.  The user signed .dsc is put into
the tag.

The tag2upload service creates the .changes files with the names and
checksums of the compressed files.  It is then signed by the upload
tool.

Accepting a package with dak would looks more like this:
- Verify signature on .changes.
- Check for source-only (forced by the upload tool flag).
- Check checksums of included files.
- Verify signature of .dsc.
- Check ACL against user signature on .dsc.
- Decompress (this poses a DoS threat!).
- Check checksums of included decompressed files.
- Either:
  - accept compressed files as is.
  - re-compress (also DoS, due to large files), calculate new checksums,
    accept.

Due to the implicit compression of files listed in .dsc, I would say
this is a new source format.

Regards,
Bastian

-- 
A little suffering is good for the soul.
		-- Kirk, "The Corbomite Maneuver", stardate 1514.0