[prev in list] [next in list] [prev in thread] [next in thread] 

List:       rpm-devel
Subject:    Re: [CVS] RPM: rpm/ CHANGES rpm/lib/ transaction.c
From:       Jeff Johnson <n3npq () mac ! com>
Date:       2008-12-06 18:29:18
Message-ID: 37C9294B-A346-4907-8AB9-862411D5ACA7 () mac ! com
[Download RAW message or body]

And, a savvy guess at the forensics that might explain why

1) this flaw/patch is Mandriva peculier
2) Mandriva uses hdlist

is that the hdlist construction was b00gered up at some
point in the past. Certainly there is no pathway through
rpmbuild -> rpmfiNew() -> rpmtsRun() that results in
fi->posttransprog == NULL, which is all the patch checks for.

But the header returned from the callback == random application bubble
gum scraped from the bottom of the application's chair from a rpmlib
rpmntsRun() POV.

That is the "core problem" with modified (by genhdlist or other unknown
processes that create header-like objects) that are passed into rpmlib
without sufficient distro/repo QA on the binary format markup contained
in hdlist.

And the bleeping (*callback) is a fundamental design flaw in rpm code,
one cannot pass complicated blobs around with no sanity checks unless
one has an adequate understanding of what QA means.

hth

73 de Jeff crossing the buggy RPM vendor streams, lookout!


On Dec 6, 2008, at 1:13 PM, Jeff Johnson wrote:

> I should be careful when throwing acid around ...
>
> Like many rpm flaws, the fix is usually in a very different
> place then where the symptom is seen.
>
> In this case, the underlying flaw is an unpopulated  
> RPMTAG_POSTTRANSPROG.
> That needs to be prevented in rpmbuild, not "best effort" skipped in
> rpmtsRun().
>
> That is my definition for "right" because there are most certainly  
> other
> missing data failure symptoms if RPMTAG_POSTTRANSPROG has gone AWOL,
> not only in rpmtsRun().
>
> hth
>
> 73 de Jeff
>

["smime.p7s" (smime.p7s)]

0	*H
 010	+0	*H
 00 rk 0
	*H
0|10	UDE10U
TC TrustCenter GmbH1%0#UTC TrustCenter Class 1 L1 CA1(0&UTC TrustCenter \
Class 1 L1 CA VI0 081202135405Z
091203135405Z0B10	UUS10UJeff Johnson10	*H
	
n3npq@mac.com0"0
	*H
0
Ҭ14B~:*;˄rx%I"^~22Wń9i,#O))~SC	` \
˨ŕ1i!~I5S)R&Ϥ(tuIAЈTOb߁>fN*5Q<1Rn&,f`iR!S~WUzsB \
SNg>Ox>ɐ{FMк00+00Q+0Eh \
ttp://www.trustcenter.de/certservices/cacerts/tc_class1_L1_CA_VI.crt02+0&http \
://ocsp.VI.tcclass1.trustcenter.de0U#0NjkJɻdK&0U00JU \
C0A0?	*,0200+$http://www.trustcenter.de/guidelines0U0UDL荺e9=7N&d?0TUM0K0I \
G EChttp://crl.VI.tcclass1.trustcenter.de/crl/v2/tc_class1_L1_CA_VI.crl03U%,0*+++
 +70U0
n3npq@mac.com0
	*H
c3#5@+Nwc<~3mJ \
2݉}dsOM3/cCåt(:ӌmxH#F?&N^?6c"*-7lu`+x|W \
ʕnbgҮV4H008 bnrd0 	*H
010	UDE10UHamburg10UHamburg1:08U
1TC TrustCenter for Security in Data Networks GmbH1"0 UTC TrustCenter Class 1 \
CA1)0'	*H 	certificate@trustcenter.de0
080718113854Z
101231225959Z0|10	UDE10U
TC TrustCenter GmbH1%0#UTC TrustCenter Class 1 L1 CA1(0&UTC TrustCenter \
Class 1 L1 CA VI00 	*H
0?N~ݤ㰾(ݙuLαlK%8H
~uH@MNCm]9Xq
K1~_݄Vfk(ѢzaW00'
@00+00L+0@http://www.trustcenter.de/certservices/ \
cacerts/tc_class_1_ca.crt0/+0#http://ocsp.tcclass1.trustcenter.de0U00JU \
C0A0?	*,0200+$http://www.trustcenter.de/guidelines0U0UNjkJɻdK&0U00 \
 ؆;http://crl.tcclass1.trustcenter.de/crl/v2/tc_class_1_ca.crlldap://www.trustc \
enter.de/CN=TC%20TrustCenter%20Class%201%20CA,O=TC%20TrustCenter%20AG,ou=rootcerts,dc=trustcenter,dc=de?certificateRevocationList?base?0
 	*H
ng,<H[<KB*8ُ˰y}e-pT-):mnzq/eJ̄tZմw"D˴W\&8kT.WƎ|W[30(0 \
0 	*H
0y10U
Root CA10Uhttp://www.cacert.org1"0 UCA Cert Signing \
Authority1!0	*H 	support@cacert.org0
070806160927Z
090805160927Z0810UCAcert WoT User10	*H
	
n3npq@mac.com0"0
	*H
0
MǼ~arqC?j(Ѝ.=
ܐ[m47囵{Hǰmgk׼=FlFَ^ \
c9hٕ/,fOcY;ik"XFS	)֟W:Z#AqW:_rIqc&ZZAKBH
 oY_x(V!zd	AHDJAdG*QXVr:tpM00U00V	`HB
 IGTo get your own certificate for FREE head over to \
http://www.CAcert.org0@U%907++ +7

+7
	`HB02+&0$0"+0http://ocsp.cacert.org0U0
n3npq@mac.com0
	*H
BmC2G$+`?kdC
o߫'iƬ'9\q459xOS@B= \
49ێ0أZ-n!Hrλy)gPmcFkrzGr1d3)g"LZ\bkR&h@[%|%@ht'?Нc]y4J


m
!ϵ[4QB}bK_gD,	?
wG:U\XC\!}i)7%7ufmW]-x|̭QćHxNF%3z3rR>~c͛y2GL<n#K/
  (_Q7nfrCejT \
q$,76ICm@C@)H4{\ZX̢T@niQjcN'.i. +(a
=F(>O1B0>00|10	UDE10U
TC TrustCenter GmbH1%0#UTC TrustCenter Class 1 L1 CA1(0&UTC TrustCenter \
Class 1 L1 CA VIrk 0	+ 0	*H 	1	*H
0	*H
	1
081206182919Z0#	*H
	1 J+}1OnFyҫ,0	+7100y10U
Root CA10Uhttp://www.cacert.org1"0 UCA Cert Signing \
Authority1!0	*H 	support@cacert.org0*H
	1 0y10U
Root CA10Uhttp://www.cacert.org1"0 UCA Cert Signing \
Authority1!0	*H 	support@cacert.org0
	*H
 y'ʘb{[D)rZN"Ԉ`5׶K%쐊Ǽ=B[e*M|XB2 \
u]h&EwNwPİa6 wp1lǥ}
UUDeRRUJI=kϖkC
t&Ǧv6ZYrR|*9Mm.χ	r<w {'0	OO3;r


______________________________________________________________________
RPM Package Manager                                    http://rpm5.org
Developer Communication List                        rpm-devel@rpm5.org

[prev in list] [next in list] [prev in thread] [next in thread]

Configure | About | News | Add a list | Sponsored by KoreLogic