pmatilai left a comment (rpm-software-management/rpm#3642)
The payload digest is tricky.
The payload digest tags 5092, 5093 and 5097 are doomed to be pointing to SHA256
forever. This is my f***up from when working towards rpm 4.14: I hardcoded the
algorithm on the verification side, thinking I'd fix it later. Only I never
did, and now its several years too late.
My other mistake when adding the payloaddigest also relates to the
configurability: I figured it'd work for this item because it worked for
per-file digests too. Only, that DIDN'T work, it was a horrible incompatibility
mess we suffered with for years! It was painful enough that I'd apparently
brushed it all under the carpet, and then went on to repeat :facepalm:
The per-file digests *are* different in that they are one of the most expesive
pieces of data there is in rpm, and duplicating that data seemed like a
non-starter back then (32bit systems were common back then, and 1GB of memory
was *huge*), it still does. But for the payload digests space/memory is a
complete non-issue, so there's no excuse for falling to that trap.
Rpm's always outlive your expectations and people expect to be able to access
them criss-cross through 20 years of versions. And that's why when adding new,
stronger algorithms rpm has to leave the old ones alone: to allow the older
versions to still verify those packages using the best algorithms they know.
Which basically means making crypto related tags per-algorithm, as is the case
with the header-only digests. That makes life simpler in some ways, annoying in
others, but it's kinda the way it has to be.
Here, we'd basically alias PAYLOADDIGEST and PAYLOADDIGESTALT to PAYLOADSHA256
and PAYLOADSHA256ALT to keep them working for existing users, and then add
PAYLOADSHA3xxx and PAYLOADSHA3xxxALT with a hardwired algorithm.
The other alternative that MIGHT *just* be within the border of possibilities
is turning the tags 5092, 5093 and 5097 into arrays, with the first element
locked to SHA256, and then additional algorithms piled on top. To do that,
hdrblobGet() would need to learn to byteswap the data, and rpmvsAppendTag()
would need to learn about this two-tag relationship.
Either way, I there's probably some extra "fun" dealing with the ALT logic and
whatnot.
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3642#issuecomment-2900139799
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/issues/3642/[email protected]>
_______________________________________________
Rpm-maint mailing list
[email protected]
https://lists.rpm.org/mailman/listinfo/rpm-maint
