[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#718225: live-build should authenticate files it downloads



Control: tags -1 patch

Patch attached. I strongly feel this should get into Jessie, so it's
been built on the debian-4.0-old branch.

This is a large patch, and I have broken certain components across
multiple commits. Here is a brief overview of the files in the attached
archive, which should be applied in numerical order.
 - #01-03 are patches for dependency issues reported separately, they
are required to be applied first in order for file #11 to then apply an
update on top of this. Daniel, I am aware that you're not accepting my
dependency changes exactly as I suggested, so you'll need to adapt these
as necessary, or if you really want to, you could skip all of these
(#03-04 & #11) without affecting the overall solution.
 - #04 is the patch for issue #1 and #4 of bug #774196, which needs
applying before my solution then changes these lines further in commit
#10. I am aware that in the debian-next branch you have just added
commits to remove sparc support, which creates a bit of an unfortunate
conflict...
 - #05-10 and #12 represent the actual solution. #05-09 do some "prep"
stuff like adding new config params, with #10 and #12 implementing the
bulk of the solution. Commits #08-09 rewrite some particular sections of
code before #10 can apply the new solution on top of it; I did them as
separate commits simply for clarity over what exactly changed.

In addition to secure wget downloads, there are one or two other
enhancements that are incidentally provided by the solution, so to
summarise the changelog:
 - Security verification of wget downloaded files added
 - Documentation and code updated to warn about use of daily installer
build, which cannot be downloaded securely
 - Caching of Contents-{arch}.gz files
 - New params for control over certain cache areas added
 - New init build stage added (used by new cache flushing mechanism
that's used for control over cache use of certain cached items)
 - Updated caching directory structure a little, as described further in
#774523

I think that essentially covers it (rushing writing this a little to get
it submitted while Daniel is actively working on LB bug reports :P )

Note: Unfortunately, Ubuntu building support will be completely broken
after this patch is supplied because Ubuntu repositories do not
currently match the Debian layout. Daniel and I feel that it is Ubuntu's
responsibility to sort out their layout, so for Ubuntu building to work
again either they must do that, or a patch must be built (which will be
relatively large, contact me if anyone else is intent on doing this so
that I can guide you on exactly what is required). This is partly
discussed in bug #774378.

Attachment: 718225.tar.gz
Description: GNU Zip compressed data


Reply to: