search

QubesOS / qubes-rpm-oxide

Rust libraries for processing RPM packages
4 stars 4 forks source link

Check that i18nstrings are valid and consistent #23

Closed DemiMarie closed 1 year ago

DemiMarie commented 2 years ago

RPM assumes that the i18ntable is at least as long as all i18nstring entries, and all released versions may read out of bounds if the i18ntable is too short. Reject packages that have any of the following:

However, an i18nstring entry with a smaller length than the preceeding i18ntable is valid and must be accepted. This just means that some translations are missing, which is a valid and legitimate situation.

Tests for all of these cases are included. The code is also reformatted with cargo fmt.

DemiMarie commented 2 years ago

PipelineRetryFailed

marmarek commented 1 year ago

This wants testing on all RPMs we care about - ideally all fc32 and all fc37 + our packages. Can you do that? If download speed and/or disk space is an issue, I can do that too.

DemiMarie commented 1 year ago

This wants testing on all RPMs we care about - ideally all fc32 and all fc37 + our packages. Can you do that? If download speed and/or disk space is an issue, I can do that too.

Can you use the scripts you used when first introducing rpmcanon in the R4.0 era?

marmarek commented 1 year ago

I don't think I have them anymore, but it wasn't complex (rsync relevant part from official mirror, and then call rpmcanon on each file). I can do that...

marmarek commented 1 year ago

For "normal" packages it works for all release+updates repos for both f32 and f37. But for debuginfo packages it fails very quickly:

updates-debug-37-x86_64/Packages/a/abrt-java-connector-container-debuginfo-1.3.2-1.fc37.x86_64.rpm
Error canonicalizing file: No I18N table found, yet I18Nstring present: TagData { tag: 3959619584, ty: 150994944, offset: 889192448, count: 16777216 }
marmarek commented 1 year ago

Thanks, now it seems to work for all the packages.