search

kpcyrd / rebuilderd

Independent verification of binary packages - reproducible builds
GNU General Public License v3.0
352 stars 23 forks source link

Colon in filename causes attestation signing to fail #94

Closed kpcyrd closed 2 years ago

kpcyrd commented 2 years ago

@foutrelis discovered reproducible packages with a colon : in their filename are flagged as BAD because the attestation can't be generated:

[2021-11-25T00:30:18Z INFO  rebuilderd_worker::rebuild] Comparing "/tmp/rebuilderd7RU43S/inputs/re2-1:20211101-1-x86_64.pkg.tar.zst" with "/tmp/rebuilderd7RU43S/out/re2-1:20211101-1-x86_64.pkg.tar.zst"
[2021-11-25T00:30:18Z INFO  rebuilderd_worker::rebuild] Files are identical, marking as GOOD
[2021-11-25T00:30:18Z INFO  rebuilderd_worker::rebuild] Generating signed link
[2021-11-25T00:30:18Z ERROR rebuilderd_worker] Unexpected error while rebuilding package package: Failed to generate in-toto attestation: illegal argument: Path cannot contain ":"
[2021-11-25T00:30:18Z INFO  rebuilderd_worker] Sending build report to rebuilderd...

This causes rebuilderd to return an Result::Err for the rebuild which is reported to the rebuilderd daemon as a failed rebuild (the log is set to an empty string in this case). This seems to affect all Arch Linux package with an epoch= set.