bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

libmakepkg: check for invalid tags in git

Browse source 
As per https://lists.archlinux.org/pipermail/arch-general/2017-July/043876.html
git doesn't check that the tag name matches what an annotated tag object
*thinks* it should be called. This is a bit of a theoretical attack and
some would argue that we should always use commits since upstream can
legitimately change a tag, but nevertheless this can result in a
downgrade attack if the git download transport was manipulated or the
upstream repository hacked.

So, check the tag blob to make sure the tag actually matches the name we
used for `git checkout`.

This really should be fixed in git itself, rather than forcing all
downstream users of git verify-tag to implement their own checks, but
the git developers disagree, see the discussion surrounding
https://public-inbox.org/git/xmqqk2hzldx8.fsf@gitster.mtv.corp.google.com/

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Eli Schwartz 2017-09-12 23:57:32 -04:00 • committed by Allan McRae
parent 64b7edd2fe
commit 39319c1860
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
scripts/libmakepkg/source/git.sh.in
View file

@ -65,7 +65,7 @@ download_git() {
} }
extract_git() { extract_git() {
local netfile=$1 local netfile=$1 tagname
local fragment=$(get_uri_fragment "$netfile") local fragment=$(get_uri_fragment "$netfile")
local repo=$(get_filename "$netfile") local repo=$(get_filename "$netfile")
@ -110,6 +110,15 @@ extract_git() {
esac esac
fi fi
if [[ ${fragment%%=*} = tag ]]; then
tagname="$(git tag -l --format='%(tag)' "$ref")"
if [[ -n $tagname && $tagname != $ref ]]; then
error "$(gettext "Failure while checking out version %s, the git tag has been forged")" "$ref"
plain "$(gettext "Aborting...")"
exit 1
fi
fi
if [[ $ref != "origin/HEAD" ]] || (( updating )) ; then if [[ $ref != "origin/HEAD" ]] || (( updating )) ; then
if ! git checkout --force --no-track -B makepkg $ref; then if ! git checkout --force --no-track -B makepkg $ref; then
error "$(gettext "Failure while creating working copy of %s %s repo")" "${repo}" "git" error "$(gettext "Failure while creating working copy of %s %s repo")" "${repo}" "git"