Panu Matilainen [Fri, 13 Jan 2012 14:21:11 +0000 (16:21 +0200)]
Change fsmReadLink() to take "normal" arguments
- This doesn't need access to the entire fsm, it just needs a buffer
to place the results in / return errors. Currently the "out" buffer
is (ab)used for the results, this just forces that to stand out
and should make it easier to sanitize later.
Panu Matilainen [Fri, 13 Jan 2012 13:23:23 +0000 (15:23 +0200)]
Change fsmUtime() to take "normal" arguments
- This doesn't need access to the entire fsm, just path and mtime
from coming from a header originally. Will allow eliminating
save -> abuse -> restore behavior in caller but leaving till later...
Panu Matilainen [Fri, 13 Jan 2012 13:14:24 +0000 (15:14 +0200)]
Change fsmChown(), fsmLChown() and fsmChmod() to take "normal" arguments
- None of these needs access to the entire fsm, they only
exist to map and filter errors to rpm special needs and to
create debug swew on top of the plain syscalls.
Panu Matilainen [Fri, 13 Jan 2012 13:06:06 +0000 (15:06 +0200)]
Change fsmMkdir() to take "normal" arguments
- This doesn't need access to the entire fsm, it only exists to
map errors to CPIOERR_* and create debug foo. This will allow
eliminating save -> abuse -> restore behavior in callers, but
leaving that till later.
Panu Matilainen [Fri, 13 Jan 2012 12:47:19 +0000 (14:47 +0200)]
Change fsmStat() to take "normal" arguments
- This doesn't need access to the entire fsm, just regular stat()
args and a flag whether to use lstat() or stat(). "followlinks"
or such would be saner name for the flag but leaving that for now...
Panu Matilainen [Fri, 13 Jan 2012 11:01:24 +0000 (13:01 +0200)]
Change fsmRename() to take "normal" arguments
- This doesn't need access to the entire fsm, just regular rename()
args and a flags to see whether "secure" delete should be done.
In itself this only looks like more trouble, but all the callers
are fiddling and saving and restoring with fsm->[o]path just
to call this, which we can now avoid. Leaving sanitizing the
callers till later though, this is a minefield...
Panu Matilainen [Fri, 13 Jan 2012 10:36:01 +0000 (12:36 +0200)]
Change fsmUnlink() and fsmRmdir() to take "normal" arguments
- Neither of these needs access to the entire fsm, they mostly
exist to create debug cruft and to map errors to CPIOERR_*
Panu Matilainen [Fri, 13 Jan 2012 09:36:28 +0000 (11:36 +0200)]
Sanitize file capability setting in fsm
- Move parsing, setting and freeing of capabilities into simple
helper function, there's no point whatsoever having the current
capability stored in fsm when it only complicates freeing and all.
WTH was I thinking when implementing this? (well, everything in
fsm was done that way so... but that's a lame excuse)
Panu Matilainen [Fri, 13 Jan 2012 09:08:47 +0000 (11:08 +0200)]
Sanitize selinux labeling in fsm
- Move all the label foobar into a simple helper function which
finds, sets and frees the context if selinux is enabled, use
for both regular operation and orphan directory labeling.
Simplifies things a good deal...
- While the selabel handle can change during a transaction, it
wont change while the fsm is running so its sufficient to grab
it on entry instead of repeatedly calling rpmtsSELabelHandle() after
figuring out where in the world our ts might be.
Panu Matilainen [Fri, 13 Jan 2012 08:27:11 +0000 (10:27 +0200)]
Eliminate unused subdir member from fsm struct
Panu Matilainen [Fri, 13 Jan 2012 08:19:50 +0000 (10:19 +0200)]
Eliminate silly sufbuf from fsm struct
- Allocate fsm->suffix directly when suffix is needed instead.
Doesn't change anything, only makes life that little bit simpler.
Panu Matilainen [Fri, 13 Jan 2012 08:06:09 +0000 (10:06 +0200)]
Ensure installs always use a temp suffix on files
- This bogosity goes back to commit
fcf6b50378eaeac4c1f7ca215b33586b4d41072f
which was supposed to fix files getting erased if time() returns
errors (RhBug:223931). Problem is, this "fix" didn't fix anything
at all as the suffix still wouldn't be created in the error
case, even if the FSM_UNDO part did the right thing. We always
want a suffix on installs, it doesn't matter *what* the suffix is.
Panu Matilainen [Fri, 13 Jan 2012 07:41:25 +0000 (09:41 +0200)]
Remove unused "orphan" directory creation tracking variable from fsm
Panu Matilainen [Fri, 13 Jan 2012 07:30:06 +0000 (09:30 +0200)]
Move directory tracking variables out of fsm struct to local scope
- These are not used or needed outside fsmMkdirs() so its just
plain dumb to have them in the big struct. No functional changes,
just taming the fsm monster a little bit.
Panu Matilainen [Fri, 13 Jan 2012 05:54:51 +0000 (07:54 +0200)]
Add bunch of links to test-suite chroot to allow selinux to work
- With the new warning on failure to open selinux labels from
commit
7a8b75d26605cf7a3fde9f624a80d6fb8390fcbd, the test-suite
fails on large number of tests due to the extra output. This
takes care of these false alarms on F16 at least.
- Recent selinux wants /etc/selinux and /sys (for /sys/fs/selinux),
older ones would want /selinux. Add in /proc for good measure,
selinux doesn't need it butit wont hurt either, other things will
want it sooner or later.
Ales Kozumplik [Thu, 22 Dec 2011 13:53:51 +0000 (14:53 +0100)]
remove the 'path' parameter of rpmtsSELabelInit()
- It is always selinux_file_context_path() anyway.
Ales Kozumplik [Thu, 22 Dec 2011 13:34:03 +0000 (14:34 +0100)]
selinux: reopen label between transactions if necessary (RhBug: 746073)
Panu Matilainen [Thu, 12 Jan 2012 07:52:34 +0000 (09:52 +0200)]
Show arch in --last output too (RhBug:768516)
Panu Matilainen [Wed, 11 Jan 2012 13:35:16 +0000 (15:35 +0200)]
Eliminate now unnecessary runFsm() helper from psm
Panu Matilainen [Wed, 11 Jan 2012 13:30:50 +0000 (15:30 +0200)]
Eliminate no longer needed RPMFI_ISBUILD and RPMFI_ISSOURCE internal flags
Panu Matilainen [Wed, 11 Jan 2012 13:11:37 +0000 (15:11 +0200)]
Turn FSM into a blackbox, much like PSM is
- Similar in spirit to PSM blackbox treatment in
commit
df9cdb1321ada8e3b120771f91a2eefab4ac2ad5, except that
technically fsm guts are still wide-open in fsm.h due to cpio
"needing" them (yuck).
- Allows getting rid of dumb a**-backwards things like rpmfiFSM()
which is just not needed, fsm is a relatively short-lived entity
inside psm and build, nobody else needs to bother with it except
for the returned results.
- Figure out the cpio map flags in fsmSetup() where it logically belongs,
we have all the necessary info available there.
- Get rid of newFSM() and freeFSM(), we can just as well place the
fsm on stack, merge the necessary cleanup bits from freeFSM()
into fsmTeardown()
- Supposedly no functional changes, knock wood.
Panu Matilainen [Wed, 11 Jan 2012 10:17:31 +0000 (12:17 +0200)]
Eliminate archiveSize member from rpmfi
- rpmfi itself doesn't need it for anything, its only really used
for progress reporting during install. Grab the size into psm
total directly, this is already passed down to fsm.
- Removes one of the last remaining rpmfi opacity violations, just
fi->apath to go...
Panu Matilainen [Wed, 11 Jan 2012 10:16:53 +0000 (12:16 +0200)]
Explicitly tell rpmfiNew() when its being used for build
- Eliminate feeble heuristic on archive size tag not being set during
build for detecting this and have build code explicitly pass
RPMFI_ISBUILD flag instead.
- Also eliminate the pointless isSource variable from rpmfiNew() while.
Panu Matilainen [Wed, 11 Jan 2012 09:06:16 +0000 (11:06 +0200)]
Issue package install/erase progress callbacks on justdb operation too
- Large --justdb operations can take considerable amount of time as well,
getting progress bars for it is nice even if hardly necessary...
Panu Matilainen [Wed, 11 Jan 2012 08:47:28 +0000 (10:47 +0200)]
Eliminate fluff from PSM_INIT
- rpmpsmStage() runs with RPMRC_OK as assumed result, no need to
set explicitly here.
- Dont bother testing for justdb flag here. The justdb case doesn't
need fi->apath but it doesn't exactly hurt either, and we'll want
to eliminate the apath kludge sooner or later anyway.
Panu Matilainen [Wed, 11 Jan 2012 07:07:05 +0000 (09:07 +0200)]
Update translations & sync with transifex
Panu Matilainen [Tue, 10 Jan 2012 18:26:55 +0000 (20:26 +0200)]
Oops, forgot to mark our new progress messages for translation
Ville Skyttä [Tue, 10 Jan 2012 08:48:13 +0000 (10:48 +0200)]
Adapt perl and python fileattrs to file 5.10 magics
- file 5.10 has changed magics at least for perl and python scripts, samples:
5.09: a /usr/bin/perl -w script, ASCII text executable, with very long lines
5.10: Perl script, ASCII text executable, with very long lines
5.09: a /usr/bin/python script, ASCII text executable
5.10: Python script, ASCII text executable
Signed-off-by: Panu Matilainen <pmatilai@redhat.com>
Panu Matilainen [Tue, 10 Jan 2012 08:38:31 +0000 (10:38 +0200)]
Transaction element parent is a transaction element, not an integer
- Ehm, this has been broken in the python bindings since the start,
nobody noticed. Of course the parent value isn't particularly
useful in normal usage but still...
Panu Matilainen [Tue, 10 Jan 2012 08:35:30 +0000 (10:35 +0200)]
Minor cleanup to rpmte_Key()
- Fix misleading indentation, initialize Key on declaration.
No functional changes.
Panu Matilainen [Thu, 5 Jan 2012 14:23:17 +0000 (16:23 +0200)]
And finally, permit --hash and --percent cli-switches on erasures too
Panu Matilainen [Thu, 5 Jan 2012 14:17:33 +0000 (16:17 +0200)]
Add erasure callback support to rpmShowProgress() and enable on rpmErase()
- Just use the same bits as install does, they behave the same for
our purposes. On upgrades the output would get confusing especially
with --hash when package versions aren't output'ed, so we print
out extra output when entering install and erase stages. Only
do this when --hash is used (ie a human is probably watching us)
to hopefully avoid breaking scripts (including our test-suite) that
rely on the ages old behavior of non-hashed output.
Panu Matilainen [Thu, 5 Jan 2012 13:18:28 +0000 (15:18 +0200)]
Issue actual erasure progress callbacks too
- Whereas on install the progress is measured by bytes written to
disk vs total archive size, on erase the best we can do is
going by the number of files in the package. Fsm iterates backwards
on erase so we can't just use fsm->ix but need to re-revert the value.
Panu Matilainen [Thu, 5 Jan 2012 12:48:22 +0000 (14:48 +0200)]
Clean up progress callbacks in fsm/psm machinery
- Move notifications from fsm to psm side for sanity and symmetry,
psm already has members to hold the callback state.
- Replace PSM_NOTIFY "state" with a helper function that both
fsm and psm itself use (except for error callbacks which are
a bit different)
- Init psm->total early, this doesn't change and can now be
used to refer to "all done" value whatever it happens to be,
instead of magic "100" values etc.
- Packages with no files are now handled through the same path
as everything else from progress reporting pov, we just skip calls
to fsm if there are no files.
- Issue stop callbacks for install as well. While INST_CLOSE_FILE
can be (and is currently) used to detect this condition, its
conceptually an entirely different thing.
- Fix erasure callback parameters, they were reversed (starting from
total and ending with 0, ehh...)
Panu Matilainen [Thu, 5 Jan 2012 12:34:46 +0000 (14:34 +0200)]
Add enum for RPMCALLBACK_INST_STOP callback event
- Unused atm but we'll be adding this shortly
Panu Matilainen [Thu, 5 Jan 2012 12:24:33 +0000 (14:24 +0200)]
Pass and remember the controlling psm (if any) in fsm
Panu Matilainen [Wed, 4 Jan 2012 10:01:11 +0000 (12:01 +0200)]
Eliminate repackage notification remnants from fsm
- This has been unused and dead code since rpm >= 4.6.0
Panu Matilainen [Wed, 4 Jan 2012 09:31:00 +0000 (11:31 +0200)]
Use rpmtsNotify() directly for psm error callbacks
- On error we're already on our way out of the psm, no point mucking
with the psm state. No functional changes, just makes the code
a little bit shorter.
Ales Kozumplik [Wed, 4 Jan 2012 15:47:04 +0000 (16:47 +0100)]
document -D and -E in man.
Ales Kozumplik [Tue, 3 Jan 2012 11:36:30 +0000 (12:36 +0100)]
rpmOption.required is not used.
Ales Kozumplik [Tue, 3 Jan 2012 09:50:51 +0000 (10:50 +0100)]
rpmrc: do not use that nonexistent rpmOptionValue struct.
Ales Kozumplik [Wed, 4 Jan 2012 12:50:27 +0000 (13:50 +0100)]
depends.c: save us one rpmdsNew in addObsoleteErasures.
- replaces rpmdsAnyMatchesDep with rpmdsNVRMatchesDep
Ales Kozumplik [Wed, 4 Jan 2012 09:47:17 +0000 (10:47 +0100)]
depends.c: unused parameters in addUpgradeErasures, addObsoleteErasures.
- remove them.
Panu Matilainen [Tue, 3 Jan 2012 11:10:26 +0000 (13:10 +0200)]
Implement scriptlet start and stop callbacks (RhBug:606239)
- Adds two new transaction callbacks: RPMCALLBACK_SCRIPT_START and
RPMCALLBACK_SCRIPT_STOP which get issued for every scriptlet we run.
- On script start, callback can optionally return an FD which will
override transaction-wide script fd to make it easier to accurately
collect per-scriptlet output (eg per-scriptlet temporary file).
Callback is also responsible for closing the fd if it returns one.
- For both callbacks, "amount" holds the script tag number. On stop
callback, "total" holds the scriptlet exit status mapped into
OK/NOTFOUND/FAIL for success/non-fatal/fatal errors. Abusing "notfound"
for warning result is ugly but differentiating it from the other
cases allows callers to ignore SCRIPT_ERROR if they choose to
implement stop and start.
Panu Matilainen [Tue, 3 Jan 2012 09:56:37 +0000 (11:56 +0200)]
Eliminate rpm cli callback internals from the API
- rpmcliHashes*, and rpmcliProgress* and rpmcliPackagesTotal are
implementation details of rpmShowProgress() and are useless outside
of it. Make them static, these shouldn't have been exported to
begin with.
Panu Matilainen [Tue, 3 Jan 2012 09:49:32 +0000 (11:49 +0200)]
Eliminate pointless rpmcliPackagesTotal fiddling
- The total number of packages equals transaction order count, which
is passed as total to transaction start callback. In particular
messing with this from rpmtsAddInstallElement() is just stupid.
- This will break callers that are relying on rpmcliPackagesTotal value
outside a running transaction, but that's just stupid anyway. The
correct way to get number of elements in transaction set is calling
rpmtsNElements(), which has been there for a good part of a decade.
David Malcolm [Thu, 22 Dec 2011 23:59:51 +0000 (18:59 -0500)]
fix the signatures of the METH_NOARGS callbacks
Various Python method callbacks have signatures of the form:
static PyObject *
foo(some_object_subclass *obj)
and are registered within the PyMethodDef tables with the METH_NOARGS
flag [1], with a cast to (PyCFunction) due to the PyObject/subclass
mismatch.
However, such callbacks do receive two arguments: they are invoked with
a signature of this form:
static PyObject *
foo(some_object_subclass *obj, PyObject *ignored)
The CPython interpreter only uses METH_NOARGS to allow it to pass NULL as the
second parameter: there are still two parameters. The dispatch code is in
Python's Python/ceval.c:call_function:
if (flags & METH_NOARGS && na == 0) {
C_TRACE(x, (*meth)(self,NULL));
}
The fact that this has ever worked may be a coincidence of the
platform/compiler's calling conventions, and I don't think it's guaranteed to
keep working.
[1] http://docs.python.org/c-api/structures.html#METH_NOARGS
Signed-off-by: Ales Kozumplik <akozumpl@redhat.com>
David Malcolm [Thu, 22 Dec 2011 23:16:25 +0000 (18:16 -0500)]
fix use-after-free within rpmfdFromPyObject's error-handling
These lines within python/rpmfd-py.c: rpmfdFromPyObject
are the wrong way around:
Py_DECREF(fdo);
PyErr_SetString(PyExc_IOError, Fstrerror(fdo->fd));
If fdo was allocated by the call above to PyObject_CallFunctionObjArgs,
it may have an ob_refcnt == 1, and thus the Py_DECREF() frees it, so
fdo->fd is reading from deallocated memory.
Signed-off-by: Ales Kozumplik <akozumpl@redhat.com>
Ales Kozumplik [Fri, 23 Dec 2011 12:51:38 +0000 (13:51 +0100)]
Allow deprecations to work accross colors (RhBug:713323)
This enables package maintainers to:
- Force removal of a no longer supported multilib library (the patch also
removes the check against obsoleting packages of the same name).
- Deprecate packages of different header color than the package's. Note:
even x86_64 packages can have header color 1 in which case we are
currently left with no means to deprecate them from another x86_64
package. (RhBug:751574)
Ales Kozumplik [Fri, 23 Dec 2011 12:44:22 +0000 (13:44 +0100)]
depends.c:skipColor() is not longer a macro
- Prevents double evaluation of the 'ocolor' parameter.
David Malcolm [Wed, 21 Dec 2011 22:40:44 +0000 (17:40 -0500)]
mark strings extracted from PyArg_Parse* as "const"
- Various places within the bindings use PyArg_ParseTuple[AndKeywords] to
extract (char*) string arguments. These are pointers to the internal
representation of a PyStringObject, and shouldn't be modified, hence
it's safest to explicitly mark these values as (const char*), rather
than just (char*).
Signed-off-by: Ales Kozumplik <akozumpl@redhat.com>
Ales Kozumplik [Wed, 21 Dec 2011 07:43:47 +0000 (08:43 +0100)]
typo in header-py.c.
David Malcolm [Fri, 16 Dec 2011 03:24:19 +0000 (22:24 -0500)]
handle errors when constructing lists in the Python bindings
- Various functions in the Python bindings construct lists of objects, but
assume that all calls succeed. Each of these could segfault under
low-memory conditions: if the PyList_New() call fails,
PyList_Append(NULL, item ) will segfault. Similarly, although
Py_List_Append(list, NULL) is safe, Py_DECREF(NULL) will segfault.
Signed-off-by: Ales Kozumplik <akozumpl@redhat.com>
David Malcolm [Fri, 16 Dec 2011 03:22:56 +0000 (22:22 -0500)]
fix memory leaks in invocations of PyObject_Call
- Various functions in the Python bindings have expressions of the form:
PyObject_Call(callable,
Py_BuildValue(fmtstring, ...), NULL);
This leaks memory for the case when Py_BuildValue succeeds (it returns a
new reference, which is never freed; PyObject_Call doesn't steal the
reference): the argument tuple and all of its components will not be
freed (until the process exits).
Signed-off-by: Ales Kozumplik <akozumpl@redhat.com>
Panu Matilainen [Thu, 15 Dec 2011 13:21:57 +0000 (15:21 +0200)]
Oops, newlines dont belong in format extension output
- Thinko in commit
6acef96d9e1eddb588e24f924f6cf9d29ea48d64, duh
Joshua Megerman [Wed, 14 Dec 2011 15:03:29 +0000 (17:03 +0200)]
Fix brace matching on multiline constructs in perl.req (RhBug:752119)
- /usr/lib/rpm/perl.req scans for the opening brace type on lines, but
then only scans for closing curly braces ('}') instead of the proper
losing brace type when that closing brace occures on a different line.
This means that any use/require statements that occur after the
multi-line q{} statement but before the first closing curly brace in
the file will be ignored.
Signed-off-by: Panu Matilainen <pmatilai@redhat.com>
Panu Matilainen [Fri, 2 Dec 2011 10:26:08 +0000 (12:26 +0200)]
Pull in updated + new translations from Transifex
Panu Matilainen [Fri, 2 Dec 2011 10:11:05 +0000 (12:11 +0200)]
Teach debugedit about .debug_macro dwarf section (RhBug:759272)
Panu Matilainen [Thu, 1 Dec 2011 13:06:53 +0000 (15:06 +0200)]
Allow pre- and posttrans to omit interpreter or body (again)
- While most scriptlets have both an interpreter and a body, neither
is strictly required: body can be omitted in cases like special
purpose executables (eg -p /sbin/ldconfig) and for interpreter,
/bin/sh is used if missing. This has been "broken" from somewhere
around rpm 4.7.x and nobody noticed :)
Panu Matilainen [Wed, 30 Nov 2011 11:38:35 +0000 (13:38 +0200)]
Cache all but FAIL results from rpmdb header verification
- This makes a huge difference in performance if you have lots
of unsigned packages (NOTFOUND verify result) or signed packages
without key (NOKEY verify result) installed, as we previously
kept checking the same headers over and over again.
Panu Matilainen [Wed, 30 Nov 2011 11:32:56 +0000 (13:32 +0200)]
Purge rpmdb header verification cache on added pubkeys
- When new keys are added, any previous NOKEY results can become
invalid: either they become OK or FAIL, and its the FAIL case
we want to catch.
- For removed keys, previous OK could become NOKEY but that doesn't
make the header any less valid, so leave the cache alone on removal.
Panu Matilainen [Wed, 30 Nov 2011 10:01:08 +0000 (12:01 +0200)]
Enable fast-import mode for headers from rpmdb
- Assume our home turf is safe enough for this - in order to reach
the rpmdb, headers must've gone through the more rigorous checking
that's done through the rpmReadPackageFile() paths, plus in
default configuration we'll be doing further verification on the
header before loading the headers so the risk seems acceptable
for the speed gain.
Panu Matilainen [Wed, 30 Nov 2011 09:24:42 +0000 (11:24 +0200)]
Implement "fast" flag to headerImport()
- regionSwab() calling dataLength() on headerImport() is one of the
busiest paths in rpm, and dataLength() on string types is a very
expensive call as it has to walk through the string looking for \0's.
The data size is actually available most of the time by just looking
at offsets (idea lifted from rpm5.org), which is an order of magnitude
faster than crawling string data. The downside (there always is one)
is that with offsets, string data is not validated to contain
sufficient number of \0's, which means malformed headers could cause
us to crash, burn and overflow when accessing the string data.
- The new "fast" mode enables offset-based calculation at callers
discretion, ie if the caller can reasonably assume the header is
sane (known to be previously validated etc), using the fast-flag
will make header loading/importing considerably faster.
For now, only headerImport() will use the fast mode but it might
make sense to remember the setting in the header and use for other
operations as well.
Panu Matilainen [Wed, 30 Nov 2011 07:50:03 +0000 (09:50 +0200)]
Update internal callers to use headerExport(), no functional changes
Panu Matilainen [Wed, 30 Nov 2011 07:37:49 +0000 (09:37 +0200)]
Add an enhanced interface for unloading, aka exporting, headers
- Most callers need the size of the blob as well, which the unloader
internals know perfectly well but the interface doesn't support
passing it. So callers were forced to make a second call to
headerSizeof() to recalculate the size. Duh.
- Rename and export doHeaderUnload() as headerExport(), update internal
callers to use the new name. headerExport() is hopefully a bit
more obvious as a name than headerUnload() which doesn't actually
undo the effect of headerLoad() for that header, but merely exports
the data by serializing into on-disk format.
- Header size is not size_t really, its capped to fixed much lower
size. Use unsigned int to better match reality.
Panu Matilainen [Wed, 30 Nov 2011 09:00:40 +0000 (11:00 +0200)]
Update internal callers to use headerImport() instead of headerLoad()
- Pass size where possible, this is a bit redundant in places since
its already checked in various places but wont hurt anyway.
Panu Matilainen [Wed, 30 Nov 2011 07:12:48 +0000 (09:12 +0200)]
Add an enhanced interface for loading, aka importing, headers
- Unlike headerLoad(), headerImport() takes a blob size argument
to allow sanity checking the size calculated from the blob itself
against the "physical" passed-in blob size so its a bit safer.
Note that header size is capped by various things - its not size_t.
- headerImport() also takes a flags argument to allow controlling
various aspects of importing.
- Implement "take copy of blob" as a flag to headerImport(), push
the copying into headerCreate() where we already know the blob
size, avoiding the need to do double-calculations on headerCopyLoad()..
- headerLoad() and headerCopyLoad() are now just compat wrappers
around the new interface.
Panu Matilainen [Tue, 29 Nov 2011 12:27:13 +0000 (14:27 +0200)]
Consolidate header alignment calculations to helper function
- Replace no less than five copy-paste versions of the same thing into
an inlined helper function. No functional changes.
Panu Matilainen [Tue, 29 Nov 2011 08:05:44 +0000 (10:05 +0200)]
Optimize string tag length calculations in regionSwab()
- Calling memchr() is circa 35% faster on my system than doing the
same manually, and this in one of the most critical paths rpm has...
Panu Matilainen [Mon, 28 Nov 2011 12:00:45 +0000 (14:00 +0200)]
Fix classification of ELF binaries with setuid/setgid bit, oops...
Panu Matilainen [Fri, 25 Nov 2011 14:07:38 +0000 (16:07 +0200)]
Identify "font collection" (data etc) as fonts also (RhBug:757105)
Panu Matilainen [Thu, 24 Nov 2011 09:39:36 +0000 (11:39 +0200)]
Make gpg-pubkey headers properly verifiable
- The pubkey headers have been rpm v3 all the way until now, whoops :)
Pull the actual key part of the header into immutable region and
stomp a sha1 digest on the result, allowing a (much) better
verification on loading. This part inspired by stumbling on a
related discussion on rpm5.org mailing list so credits where...
- Since we only insert either literally constant data or data retrieved
from the actual key into the immutable part of the header, the
calculated digest is constant for a given key regardless of where
and when it was imported. This gives some added verification and/or
cross-checking possibilities (eg was the imported key exactly the
same as what shipped etc)
Panu Matilainen [Thu, 24 Nov 2011 09:28:15 +0000 (11:28 +0200)]
Sanitize makePubkeyHeader() calling semantics
- Create the header in makePubkeyHeader() as the name suggests,
return the newly created header to caller on success.
- Move the installtime & -tid addition to the "install" part,
makePubkeyHeader() only does the part that is specific to pubkey
headers, again as the name suggests.
- No functional changes
Panu Matilainen [Thu, 24 Nov 2011 09:25:53 +0000 (11:25 +0200)]
Make gpg-pubkey buildtime reflect the public key create time
- Pubkey buildtime has until now been the time of import, which equals
install time/tid. Which is of course the time when that header
does get created, but it seems rather redundant to have the same
thing recorded in three places. Having the key creation time
easily (easier than un-hexifying the version string, duh)
available seems like a potentially useful thing. Buildtime is
"wrong" for this, but ... so is everything.
- With this change, the "meat" of the pubkey headers is now constant
and repeatable regardless of where and when a key gets imported,
so we could stomp a digest on it and it'd be unique for that
particular key everywhere.
Panu Matilainen [Thu, 24 Nov 2011 09:19:11 +0000 (11:19 +0200)]
Add key userid into gpg-pubkey headers as "packager"
- The userid has only been available in a mildly obfuscated format
through summary, but this seems like a useful thing to have in
a directly usable format without requiring callers to parse out
the gpg() wrapping around it.
- Yes its a wonky mapping, but so is everything else wrt
gpg-pubkeys, and adding a tag just for this also seems silly.
Using vendor tag could be another possibility, dunno.
Panu Matilainen [Thu, 24 Nov 2011 09:16:19 +0000 (11:16 +0200)]
Log an error on attempt to sign V3 packages (RhBug:517818 & others)
- We haven't been able to sign V3 packages in the last decade or so,
might as well spit out an error on it instead of silently failing.
Panu Matilainen [Thu, 24 Nov 2011 08:44:14 +0000 (10:44 +0200)]
Fix dribble length calculation on headerLoad()
- When calculating length of dribbles, we need to take into account the
size up to that point, otherwise the alignment can be wrong causing
the sizes not to add up.
- With that mystery solved, we can now make the final length check
as strict as it should be.
Panu Matilainen [Tue, 22 Nov 2011 10:34:46 +0000 (12:34 +0200)]
Ehm, %pretrans failure shouldn't abort the entire transaction
- Brainfart in previous commit (
71c6b06b3f240021f2ece46f9cf7aa891f716710):
%pretrans failure should only cause that package to fail, not
abort the entire transaction. Doh.
- Failures are tracked via transaction elements but pre/posttrans
were specifically filtered out. All we need is removing that filtering
and the warn-only vs error logic in psm takes care of the rest.
The transaction.c changes in previous commit were just unnecessary.
Panu Matilainen [Tue, 22 Nov 2011 09:24:22 +0000 (11:24 +0200)]
Make %pretrans failure fail the install (RhBug:736960)
- %pre and %preun scriptlets cause the package install/erase to fail,
whereas %pretrans return has simply been ignored ever since its
introduction somewhere in rpm <= 4.4.x. This is just inconsistent,
make %pretrans more like the other %pre-scriptlets. %posttrans
exit code is still essentially ignored, just like %post and %postun etc.
- This can obviously affect installability of existing packages: if
they have been careless about their %pretrans exit code or outright
relying on the "yes it spits errors in some situations but who cares"
behavior, they will now fail to install at all. The way to write
"portable" %pretrans scriptlets is ensuring non-error exit.
Ales Kozumplik [Fri, 18 Nov 2011 10:36:20 +0000 (11:36 +0100)]
inverse the macro definition condition in c87ad03.
- thanks zpavlas for pointing this out.
Ales Kozumplik [Tue, 15 Nov 2011 14:49:33 +0000 (15:49 +0100)]
python: use the more modern PyCapsule over PyCObject (RhBug:623864).
- rpm.header.new() will still keep accepting PyCObject for now in case a
client library depends on this.
- involves macro trickery to make rpm buildable against python 2.6 still.
Ales Kozumplik [Thu, 10 Nov 2011 12:37:42 +0000 (13:37 +0100)]
cosmetic: indentation in rpmdbNextIterator.
- the hunk looked confusing with the wrong indentation.
Ales Kozumplik [Fri, 11 Nov 2011 09:38:49 +0000 (10:38 +0100)]
Recognize "<epoch>:" as a part of a label (ticket #117)
- for instance this works now:
$ rpm -q perl-4:5.14.1-188.fc16.x86_64
perl-5.14.1-188.fc16.x86_64
Ales Kozumplik [Mon, 14 Nov 2011 08:58:04 +0000 (09:58 +0100)]
Do not attempt running the test suite without fakechroot (ticket #851).
Partially resolves ticket #851.
Panu Matilainen [Mon, 14 Nov 2011 08:20:42 +0000 (10:20 +0200)]
Avoid XZ dependency in test-suite
- The two "hello" binaries packages used for various multilib checks were
accidentally using xz payload compression, causing test-suite to
fail when rpm was configured without xz support. Rebuild them with gzip
compression instead to avoid silly failures - gzip compression
support is mandatory, xz is not.
Panu Matilainen [Thu, 10 Nov 2011 06:46:23 +0000 (08:46 +0200)]
Doh, somehow managed to miss the warnings from these missing includes :(
- Should've been in commit
70f063cb773bedb7d336429d9bc8ed1d4e5d18f4
Panu Matilainen [Wed, 9 Nov 2011 13:04:13 +0000 (15:04 +0200)]
Make base64 encoding/decoding part of rpmio public API
- Base64 is present in headers and all, it's only reasonable that
our API users have access to this functionality without having
to link to other libraries. Even if we didn't want to carry the
implementation forever in our codebase, we should provide a wrapping
for this (much like the other crypto stuff) for the reason stated above.
- A bigger issue is that our dirty little (badly hidden) secret was using
non-namespaced function names, clashing with at least beecrypt. And we
couldn't have made these internal-only symbols even on platforms that
support it, because they are used all over the place outside rpmio.
So... rename the b64 functions to rpmLikeNamingStyle and make 'em public.
No functional changes, just trivial renaming despite touching numerous
places.
Panu Matilainen [Wed, 9 Nov 2011 11:55:08 +0000 (13:55 +0200)]
Eliminate uses of pgpDig in package signing routines
- No functional changes, just eliminates pile of unnecessary allocations
and other calls, simplifying the code a bit.
Panu Matilainen [Wed, 9 Nov 2011 11:43:09 +0000 (13:43 +0200)]
Eliminate uses of pgpDig in package reading & signature checking
- No functional changes, just eliminates pile of unnecessary allocations
and other calls, simplifying the code a bit.
Panu Matilainen [Wed, 9 Nov 2011 11:28:23 +0000 (13:28 +0200)]
Take advantage of pgpPrtParams() directly in pgpsigFormat() extension
- No functional changes, just bypassing an unnecessary round-trip to
a function really intended for other purposes, now that we can.
Panu Matilainen [Wed, 9 Nov 2011 11:05:08 +0000 (13:05 +0200)]
Switch to using rpmKeyringVerifySig() internally
- Change rpmVerifySignature() to take just the signature parameters
instead of the whole dig (this is an internal API so we're free
to mess with it) from which it only needed the signature params.
- The internal low-level verifySignature() is thus reduced to
to a call to rpmKeyringVerifySig() and spitting some silly
strings to msg.
- With this, keyring can now use and reuse the its internally stored
pgp key parameters instead of having to parse the same PGP packets
over and over. As a result, signature checking is faster now. Not
dramatically so but measurably nevertheless.
Panu Matilainen [Wed, 9 Nov 2011 10:47:02 +0000 (12:47 +0200)]
Add a signature verification method to keyring
- At least within rpm itself, callers aren't particularly interested
in the actual key that matches a given signature, they just want
simple good/bad/nokey answers. This makes life simple for them
and avoids exposing further rpmPubkey internals through APIs.
Panu Matilainen [Wed, 9 Nov 2011 10:31:23 +0000 (12:31 +0200)]
Split keyring find-by-signature to helper function, document...
- Document the broken rpmKeyringLookup() behavior / side-effect,
the new helper uses the values from our stored pgp parameters though.
- Shouldn't make any difference functionality-wise, but we'll need
the helper function shortly.
Panu Matilainen [Wed, 9 Nov 2011 09:59:31 +0000 (11:59 +0200)]
Parse pubkey parameters on rpmPubkeyNew() already and store results
- Yet more pre-requisites for separating key and signature management.
In addition this gains us more thorough initial sanity checking and
will allow reusing the parameters instead of having to parse
the same packets over and over again on every single verification
against this key. Unfortunately rpmKeyringLookup() is so braindead
it prevents us from doing this right now, we'll need a better
interface to take advantage of the stored pgp key parameters.
Panu Matilainen [Wed, 9 Nov 2011 09:04:51 +0000 (11:04 +0200)]
Add an alternative API for parsing PGP packets
- pgpPrtParams() returns a pointer to an allocated pgpDigParams
on success, eliminating the need for callers to worry about
freeing "target buffer" on failure and bypassing the now rather
useless pgpDig middleman. Also allows specifying the expected
packet type so if we expect a key we'll error out if we get a signature
instead.
- pgpPrtPkts() is basically just a wrapper to pgpPrtParams()
- Further pre-requisites for separating key and signature management.
- Yes, pgpPrtParams() is a stupid name for this. However all the saner
ones are already taken for other purposes (for which the names are
just as bad/misleading, sigh)
Panu Matilainen [Wed, 9 Nov 2011 07:49:26 +0000 (09:49 +0200)]
Allocate signature and pubkey dynamically within pgpDig on PGP parse
- This way we can parse the whole thing into a private storage first
and only if its actually successful we return anything through the
pgpDig. Previously we would return partial garbage on failure
and/or consecutive calls unless manually "cleaned" as we were
parsing directly into the pgpDig.
- Dynamic allocation is a pre-requirement separating management of
keys and signatures: while they walk hand in hand much of the time,
they come from different sources and have different lifetimes and
should be managed separately.
- Dynamic allocation of these is also a pre-requirement for handling
more than one public key, ie mainly subkeys.
Panu Matilainen [Wed, 9 Nov 2011 07:37:15 +0000 (09:37 +0200)]
Use pgpDigGetParams() in pgpVerifySig() compat wrapper too
- The fewer places that "know" about pgpDig allocation internals the better...
Panu Matilainen [Wed, 9 Nov 2011 07:19:48 +0000 (09:19 +0200)]
Don't make assumptions about how pgpDig allocates things
- Only call pgpDigGetParams() on the public key once we've at least
tried to fetch it via rpmKeyringLookup(). This way we dont assume
things about how pgpDig internal allocation is done - currently
it does return what's essentially a static pointer into pgpDig,
but this is not a reasonable assumption for an opaque type.
No functional changes.
Panu Matilainen [Tue, 8 Nov 2011 13:08:01 +0000 (15:08 +0200)]
Revert "Take advantage of pgpDigParamsCmp() in rpmKeyringLookup()"
- This only "works" because of other brokenness in the sig/key
parsing, revert while we can
- This reverts commit
4c51eff3f0fa5e67494b6b192aa1c087f57abed6.
Panu Matilainen [Tue, 8 Nov 2011 12:08:40 +0000 (14:08 +0200)]
Tolerate NULL key in pgpVerifySignature()