1 |
commit: 516c2ecec8f48f2f8ab7ee47cb9aebcac8347ef5 |
2 |
Author: Michał Górny <mgorny <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Nov 13 16:49:55 2017 +0000 |
4 |
Commit: Michał Górny <mgorny <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Nov 13 16:49:55 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/data/glep.git/commit/?id=516c2ece |
7 |
|
8 |
glep-0074: Forbid compressing top-level Manifest |
9 |
|
10 |
glep-0074.rst | 25 ++++++++++++++++++++++--- |
11 |
1 file changed, 22 insertions(+), 3 deletions(-) |
12 |
|
13 |
diff --git a/glep-0074.rst b/glep-0074.rst |
14 |
index 97d7829..b4dd7a0 100644 |
15 |
--- a/glep-0074.rst |
16 |
+++ b/glep-0074.rst |
17 |
@@ -342,9 +342,11 @@ the compression and decompress Manifests transparently. The exact list |
18 |
of algorithms and their corresponding suffixes are outside the scope |
19 |
of this specification. |
20 |
|
21 |
-Whenever this specification refers to top-level Manifest file, |
22 |
-the implementation should account for compressed variants of this file |
23 |
-with appropriate suffixes (e.g. ``Manifest.gz``). |
24 |
+The top-level Manifest file must not be compressed. Since the OpenPGP |
25 |
+signature covers the uncompressed text and is compressed itself, |
26 |
+the data would have to be decompressed without any prior verification. |
27 |
+This could expose users e.g. to zip bombs or exploits on decompressor |
28 |
+vulnerabilities. |
29 |
|
30 |
Whenever this specification refers to sub-Manifests, they can use any |
31 |
names but are also required to use a specific compression suffix. |
32 |
@@ -722,6 +724,23 @@ to the file format. The ``MANIFEST`` entries are required to provide |
33 |
the real (compressed) file path for compatibility with other file |
34 |
entries and to avoid confusion. |
35 |
|
36 |
+The compression of top-level Manifest file has been prohibited |
37 |
+as the specification currently does not provide any means of verifying |
38 |
+the file prior to decompression. This would make it possibly for |
39 |
+a malicious third party to provide a compressed Manifest exposing |
40 |
+decompressor vulnerabilities, or being a zip bomb, and the tooling |
41 |
+would have to unpack it before being able to verify the contents. |
42 |
+ |
43 |
+The OpenPGP cleartext signature covers the contents of the Manifest, |
44 |
+and is therefore compressed along with them. The possibility of using |
45 |
+detached signature has been considered but it was rejected as |
46 |
+unnecessary complexity for minor gain. |
47 |
+ |
48 |
+Technically, a similar result could be effected via moving all the data |
49 |
+into a compressed sub-Manifest in the top directory (e.g. |
50 |
+``Manifest.sub.gz``), and including a ``MANIFEST`` entry for this file |
51 |
+in a signed, uncompressed top-level Manifest. |
52 |
+ |
53 |
The existence of additional entries for uncompressed Manifest checksums |
54 |
was debated. However, plain entries for the uncompressed file would |
55 |
be confusing if only compressed file existed, and conflicting if both |