glitchedgitz / cook

A wordlist framework to fullfill your kinks with your wordlists. For security researchers, bug bounty and hackers.
https://twitter.com/glitchedgitz
MIT License
1.01k stars 104 forks source link

Version / release / git tags consistency #31

Closed noraj closed 2 years ago

noraj commented 2 years ago

Context

I was surprise the BA PKGBUILD for cook was using version 1.6 and 2.0 because we are using the last commit (217) from the git source and not a specific release.

Troubleshooting

While building the PKGBUILD manually I found that it was targeting version 1.6 (see screenshot)

image

I'm not familiar with go building process, but it seems that the following commands (https://github.com/BlackArch/blackarch/blob/cd42e3f9aa06e236bd22d18ad9a11ac5265e9895/packages/cook/PKGBUILD#L25-L34) are fetching the @latest release. So I checked the git tags here and found they were inconsistent: 1.0, v1.5, v1.6.0, 2.0.a, 2.0. Sometimes it using x.y and sometimes x.y.z (not following semver https://semver.org/) but more importantly sometimes it has the v prepended and sometimes not. So I think the go resolver find that v1.6.0 is matching @latest because alphabetically v.1.6.0 is higher than 2.0 (ASCII order).

irb(main):001:0> ['1.0', 'v1.5', 'v1.6.0', '2.0.a', '2.0'].sort
=> ["1.0", "2.0", "2.0.a", "v1.5", "v1.6.0"]

Solution

Solution A

Remove old git tags and create new git tags that all match the same versioning convention.

Example of end result:

1.0.0
1.5.0
1.6.0
2.0.0
2.0.0-a

# or

v1.0.0
v1.5.0
v1.6.0
v2.0.0
v2.0.0-a

Solution B

If you want to keep the old references, you can create new tags following the convention with the higher precedence.

Example of end result:

1.0
2.0
2.0.a
v1.0.0
v1.5
v1.5.0
v1.6.0
v2.0.0
v2.0.0-a

About 2.0.0 and 2.0.0-a 2.0.0-a < 2.0.0 (see semver precedence) so no worry it's not alphabetically in the right order. If you want to be extra sure make the actual 2.0 become 2.0.1.

glitchedgitz commented 2 years ago

Thanks @noraj I just changed the tag to v2.0.0, Hope this should work.

noraj commented 2 years ago

Seems to point to it now:

image

glitchedgitz commented 2 years ago

Great! Thanks @noraj for the solution. Nice Catch!!