[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: scratch/package-security bcde5f8 2/2: Support expiration of metadata
From: |
Stefan Monnier |
Subject: |
Re: scratch/package-security bcde5f8 2/2: Support expiration of metadata by package archives |
Date: |
Wed, 25 Nov 2020 20:01:12 -0500 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux) |
> @@ -449,6 +458,7 @@ synchronously."
> (define-error 'bad-size "Package size mismatch" 'package-error)
> (define-error 'bad-signature "Failed to verify signature" 'package-error)
> (define-error 'bad-checksum "Failed to verify checksum" 'package-error)
> +(define-error 'bad-timestamp "Failed to verify timestamp" 'package-error)
Hmm, these errors should all have a `package-` prefix.
>
> ;;; `package-desc' object definition
> @@ -1812,6 +1822,100 @@ Once it's empty, run
> `package--post-download-archives-hook'."
> (message "Package refresh done")
> (run-hooks 'package--post-download-archives-hook)))
>
> +(defun package--parse-header-from-buffer (header name)
> + "Find and return \"archive-contents\" HEADER for archive NAME.
> +This function assumes that the current buffer contains the
> +\"archive-contents\" file.
> +
> +A valid header looks like: \";; HEADER: <TIMESTAMP>\"
> +
> +Where <TIMESTAMP> is a valid ISO-8601 (RFC 3339) date. If there
> +is such a line but <TIMESTAMP> is invalid, show a warning and
> +return nil. If there is no valid header, return nil."
> + (save-excursion
> + (goto-char (point-min))
> + (when (re-search-forward (concat "^;; " header ": *\\(.+?\\) *$") nil t)
> + (condition-case-unless-debug nil
> + (encode-time (iso8601-parse (match-string 1)))
> + (lwarn '(package timestamp)
> + (list (format "Malformed timestamp for archive `%s': `%s'"
> + name (match-string 1))))))))
Hmm... I think you forgot the `error` in this
`condition-case-unless-debug` (i.e. the way you wrote it, it will catch
all `lwarn` errors).
> +(defun package--parse-valid-until-from-buffer (name)
> + "Find and return \"Valid-Until\" header for archive NAME."
> + (package--parse-header-from-buffer "Valid-Until" name))
It would be easier for the ELPA archives is to use a "validity duration"
header, since it could then be constant.
Other that that, LGTM,
[ BTW, to mitigate against replay attacks in the absence of timestamps,
we could compare the last `archive-content` with the new one and make
sure that none of the packages's version got smaller. ]
Stefan
- Re: scratch/package-security bcde5f8 2/2: Support expiration of metadata by package archives,
Stefan Monnier <=