Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 13429] New: default_pre_build does not verify all the sources

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 13429] New: default_pre_build does not verify all the sources
  • Date: 19 Jan 2007 19:12:55 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=13429

Summary: default_pre_build does not verify all the sources
Product: Codex
Version: test grimoire
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: FUNCTIONS
AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
ReportedBy: jakakranjc AT email.si
CC: sobukus AT sourcemage.org


The default_pre_build from sorcery only unpacks and verifies the first
source.
This means that if we don't add verify_file 2 and others to PRE_BUILD, any
other source will skip verification. It doesn't matter if DETAILS has any of
SOURCEn_GPG/SOURCEn_HASH/SOURCEn_IGNORE set, it simply won't be looked at. So
we have a small security vulnerability.

example: commit 400319c3a2ab7c3e6f5d54b740db7d323db4d04b

We have two choices:
1. add all the missing verify_file calls
2. fix the default function and fix any inconsistencies (candidates are the
spells that have more-than-default PRE_BUILD ...)

I'm for 2., so we don't need to think about it in the future* and I also
speculate that it requires less work.

afrayedknot said it would be best if we fixed this in the grimoire (first),
so
let's do it. I'll adapt the function, then we can start going through
sections,
overriding the function there and checking for problems. Once all of them are
ok, we can override it at grimoire level and then someday it may even get
into
sorcery.

* all this time I only knew about needing to add extra unpack calls if needed
:/

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Grimoire-Bugs] [Bug 13429] New: default_pre_build does not verify all the sources, bugzilla-daemon, 01/19/2007

Archive powered by MHonArc 2.6.24.

Top of Page