[Rpm-maint] [rpm-software-management/rpm] RPM with Copy on Write (#1470)

[malmond77]

@DemiMarie : this is an excellent point. There is verification of the whole rpm file in librepo (see https://github.com/rpm-software-management/librepo/pull/222) and rpm signature verification is done after that, but there remains the possibility of a rogue mirror offering bad data into a compression library.

My answer for tonight is that this depends on whether you trust your mirrors. This proposal assumes you do, and I will update the linked proposal with this caveat tomorrow. The bottom line: this is opt in, and not intended to be enabled anywhere by default today.

In the immediate future, I will investigate potential solutions. The one I came up with tonight involves PAYLOADDIGESTALT or another header with a list of digests per reasonable sized block of compressed data, pre-decompression. Example: SHA256 with 1MiB block size would add a trivial overhead, but allow data to be verified before feeding into a decompression library. This would require support for a digest of the headers in the repodata's primary.xml[1], and would in turn be part of the checksum in repomd.xml and the metalink mirror infra. I am looking at [1] for related reasons.

I am definitely open to suggestions. Thank you for this very valuable feedback.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1470#issuecomment-752335847
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20201229/bc309d21/attachment.html>