Update transaction doesn't properly verify uncompressed index

haskell / hackage-security

Hackage security framework based on TUF (The Update Framework)

http://hackage.haskell.org/package/hackage-security

56 stars 47 forks source link

Update transaction doesn't properly verify uncompressed index #196

Closed hvr closed 6 years ago

hvr commented 6 years ago

The current code blindly assumes that the pre-existing index.tar is a prefix to the new uncompressed index.tar; this assumption doesn't hold when a package repository for whatever reason respins the index tarball or there is a local filesystem data corruption.