From 0b2c66dc0ac9fab7ade55bf301cbadfbb78d18ee Mon Sep 17 00:00:00 2001 From: nalla Date: Tue, 14 Apr 2015 06:59:16 +0100 Subject: [PATCH] pacman: Sanity check the final DB URL When using the *internal* downloader the returned `final_db_url` is appended by the postfix `.sig` without checking if the `final_db_url` is indeed sane. Possible redirects by the server *could* have altered it and therefore it should be checked before being processed any further. For example, Bintray redirects all of its URLs, but it is not a dynamic redirector, as is visible by the URL: it does not end in `.sig` at all, but rather is a long hexadecimal string. The `pacman` ML already contains a patch for this kind of behavior. This commit will apply that patch before building `pacman` for *MSYS2*. Signed-off-by: nalla Signed-off-by: Johannes Schindelin --- ...heck-before-maniplating-final-DB-URL.patch | 52 +++++++++++++++++++ pacman/PKGBUILD | 7 ++- 2 files changed, 57 insertions(+), 2 deletions(-) create mode 100644 pacman/0005-Do-a-sanity-check-before-maniplating-final-DB-URL.patch diff --git a/pacman/0005-Do-a-sanity-check-before-maniplating-final-DB-URL.patch b/pacman/0005-Do-a-sanity-check-before-maniplating-final-DB-URL.patch new file mode 100644 index 00000000..a6ef01da --- /dev/null +++ b/pacman/0005-Do-a-sanity-check-before-maniplating-final-DB-URL.patch @@ -0,0 +1,52 @@ +From 8f30aeec9e5c9feab3df9a96ed618673083b0258 Mon Sep 17 00:00:00 2001 +From: David Macek +Date: Mon, 13 Apr 2015 19:33:36 +0000 +Subject: [PATCH] libalpm: Do a sanity check before manipulating final DB URL + +The change in commit 9d96bed9d6b57 causes download errors for the .db.sig file +in case the final URL for the .db file contains query strings or other +unexpected stuff. This commit isn't intended to be a total solution, but it +should eliminate the problem in the most obvious cases. +--- + lib/libalpm/be_sync.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/lib/libalpm/be_sync.c b/lib/libalpm/be_sync.c +index 20130dc..56fd016 100644 +--- a/lib/libalpm/be_sync.c ++++ b/lib/libalpm/be_sync.c +@@ -241,20 +241,26 @@ int SYMEXPORT alpm_db_update(int force, alpm_db_t *db) + unlink(sigpath); + free(sigpath); + +- /* if we downloaded a DB, we want the .sig from the same server - +- this information is only available from the internal downloader */ +- if(handle->fetchcb == NULL) { ++ /* check if the final URL from internal downloader looks reasonable */ ++ if(final_db_url != NULL) { ++ if(strlen(final_db_url) < 3 || strcmp(final_db_url + strlen(final_db_url) - 3, ".db") != 0) { ++ final_db_url = NULL; ++ } ++ } ++ ++ /* if we downloaded a DB, we want the .sig from the same server */ ++ if(final_db_url != NULL) { + /* print final_db_url into a buffer (leave space for .sig) */ + len = strlen(final_db_url) + 5; + } else { +- /* print server + filename into a buffer (leave space for .sig) */ ++ /* print server + filename into a buffer (leave space for .db.sig) */ + len = strlen(server) + strlen(db->treename) + 9; + } + + /* TODO fix leak syncpath and umask unset */ + MALLOC(payload.fileurl, len, RET_ERR(handle, ALPM_ERR_MEMORY, -1)); + +- if(handle->fetchcb == NULL) { ++ if(final_db_url != NULL) { + snprintf(payload.fileurl, len, "%s.sig", final_db_url); + } else { + snprintf(payload.fileurl, len, "%s/%s.db.sig", server, db->treename); +-- +2.3.5 + diff --git a/pacman/PKGBUILD b/pacman/PKGBUILD index c274e6d6..f8a2838b 100644 --- a/pacman/PKGBUILD +++ b/pacman/PKGBUILD @@ -54,7 +54,8 @@ source=("$pkgname"::'git://github.com/Alexpux/MSYS2-pacman.git' "0001-more-debugging-info.patch" "0002-Add-util-msys2.-c-h-and-rebase-db-msys2.-c.patch" "0003-use-busybox-for-msys2-post-installs.patch" - "0004-Link-pacman-with-static-libraries.patch") + "0004-Link-pacman-with-static-libraries.patch" + "0005-Do-a-sanity-check-before-maniplating-final-DB-URL.patch") md5sums=('SKIP' 'a74be5548ab4743ef05712ebff0b8472' 'fc9e737a24f08f842f1f4c54bdcaa653' @@ -64,7 +65,8 @@ md5sums=('SKIP' '3478ac5ab27b8cdb289d1ac3792b16ec' 'feb2bcc62db05f7bc6ac97d43dd0643a' '9ee3ca289031ca9c92db2805b75c1944' - '99f8ee6e6df141c9fa98f186ba8fa79c') + '99f8ee6e6df141c9fa98f186ba8fa79c' + '37f1dddc5a448fecc983ccad77855c7d') pkgver() { cd "$srcdir/$pkgname" @@ -78,6 +80,7 @@ prepare() { #git am "$srcdir"/0002-Add-util-msys2.-c-h-and-rebase-db-msys2.-c.patch #git am "$srcdir"/0003-use-busybox-for-msys2-post-installs.patch git am "$srcdir"/0004-Link-pacman-with-static-libraries.patch + git am "$srcdir"/0005-Do-a-sanity-check-before-maniplating-final-DB-URL.patch # Workaround for symlinks rm src/util/util-common.{h,c}