SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=13429

           Summary: default_pre_build does not verify all the sources
           Product: Codex
           Version: test grimoire
          Platform: Other
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P2
         Component: FUNCTIONS
        AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
        ReportedBy: jakakranjc AT email.si
                CC: sobukus AT sourcemage.org


The default_pre_build from sorcery only unpacks and verifies the first 
source. 
This means that if we don't add verify_file 2 and others to PRE_BUILD, any 
other source will skip verification. It doesn't matter if DETAILS has any of 
SOURCEn_GPG/SOURCEn_HASH/SOURCEn_IGNORE set, it simply won't be looked at. So 
we have a small security vulnerability.

example: commit 400319c3a2ab7c3e6f5d54b740db7d323db4d04b

We have two choices:
1. add all the missing verify_file calls
2. fix the default function and fix any inconsistencies (candidates are the 
spells that have more-than-default PRE_BUILD ...)

I'm for 2., so we don't need to think about it in the future* and I also 
speculate that it requires less work.

afrayedknot said it would be best if we fixed this in the grimoire (first), 
so 
let's do it. I'll adapt the function, then we can start going through 
sections, 
overriding the function there and checking for problems. Once all of them are 
ok, we can override it at grimoire level and then someday it may even get 
into 
sorcery.

* all this time I only knew about needing to add extra unpack calls if needed 
:/

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.