Re: [gentoo-pms] empty Manifest files

[Robin H. Johnson]

On Mon, Sep 12, 2016 at 11:26:37PM +0200, Ulrich Mueller wrote:
> Section 4.3 "Package Directories" says:
> <https://projects.gentoo.org/pms/6/pms.html#x1-340004.3>
>
>    A package directory contains the following:
>    [...]
>    * A Manifest file, whose format is described in [GLEP 44].
>
> Which is the only item not marked as optional in that list. Now with
> thin manifests the file can end up empty, in which case it is omitted
> (e.g. if the package contains only live ebuilds).
>
> So, should we enforce that there is always a Manifest file even if it
> is empty, or should we update the spec? I would suggest the latter.
An empty Manifest is a specific case to consider for MetaManifest and
package manager security concerns: The MetaManifest specification needs
to related update to declare that it must be used with non-thin
Manifests (this prevents an attack that injects a Manifest not covered
by the MetaManifest).

As long as that case is handled correctly, I think permitting the
absence of a thin Manifest is a good idea; with the related remark that
thick Manifests can never be empty.

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Trustee & Treasurer
E-Mail   : robbat2@g.o
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136