Bug#745563: debsig-verify: only handles data.tar.gz member, not xz, bz2 or lzma

[Guillem Jover]

Hi!

On Tue, 2014-04-22 at 21:00:06 +0100, Vivek Das Mohapatra wrote:
 Package: debsig-verify
 Version: 0.8
 Severity: normal
 Tags: patch
 
 debsig-verify only handles a main data archive member of data.tar.gz,
 packages can contain bz2, xz or lzma compressed members instead.

I'm preparing a QA upload, which will be fixing this report, as part
of trying to get https://wiki.debian.org/Teams/Dpkg/DebSupport
greener.

 Attached is the patch I used to get it to work for me.

Thanks for the patch! I've amended the patch to also support data.tar,
control.tar and control.tar.xz.

Thanks,
Guillem


-- 
To UNSUBSCRIBE, email to debian-qa-packages-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: https://lists.debian.org/20140510053444.ga26...@gaara.hadrons.org

Bug#745563: debsig-verify: only handles data.tar.gz member, not xz, bz2 or lzma

[Vivek Das Mohapatra]

Package: debsig-verify
Version: 0.8
Severity: normal
Tags: patch

debsig-verify only handles a main data archive member of data.tar.gz,
packages can contain bz2, xz or lzma compressed members instead.

Attached is the patch I used to get it to work for me.diff --exclude TAGS --exclude changelog -ur debsig-verify-0.8.orig/debsig-verify.c debsig-verify-0.8/debsig-verify.c
--- debsig-verify-0.8.orig/debsig-verify.c	2014-04-22 18:25:43.156139964 +0100
+++ debsig-verify-0.8/debsig-verify.c	2014-04-22 18:15:10.605619731 +0100
@@ -38,7 +38,9 @@
 char *deb = NULL;
 FILE *deb_fs = NULL;
 
-char *ver_members[] = { debian-binary, control.tar.gz, data.tar.gz, 0 };
+char *ver_members[] = { debian-binary, control.tar.gz, 0 };
+#define DTAR(x) data.tar. # x
+char *ver_mem_maybe[] = { DTAR(gz), DTAR(xz), DTAR(bz2), DTAR(lzma), 0 };
 
 static char *prog_name = NULL;
 
@@ -97,6 +99,7 @@
 int opt_count = 0, t, i, fd;
 struct match *mtc;
 int len;
+int data_tar = 0;
 
 /* If we don't have any matches, we fail. We don't want blank,
  * take-all rules. This actually gets checked while we parse the
@@ -127,6 +130,22 @@
 	len -= t;
 	}
 }
+
+for (i = 0; ver_mem_maybe[i]; i++) {
+if (!(len = findMember(ver_mem_maybe[i])))
+continue;
+while (len  0){
+t = fread(buf, 1, sizeof(buf), deb_fs);
+fwrite(buf, 1, (t  len) ? len : t, fp);
+len -= t;
+}
+data_tar = 1;
+break;
+}
+
+if(!data_tar)
+goto fail_and_close;
+
 fclose(fp);
 fd = -1;
 
@@ -209,14 +228,23 @@
 
 static int checkIsDeb(void) {
 int i;
-if (!findMember(debian-binary))
-return 0;
+const char *mem;
 
-for (i = 0; ver_members[i]; i++)
-if (!findMember(ver_members[i]))
-	return 0;
+for (i = 0; mem = ver_members[i]; i++)
+if (!findMember(mem)) {
+ds_printf(DS_LEV_VER, Missing archive member %s, mem);
+return 0;
+}
 
-return 1;
+for (i = 0; mem = ver_mem_maybe[i]; i++)
+if (findMember(mem))
+return 1;
+
+ds_printf(DS_LEV_VER, Missing archive data member, checked:);
+for (i = 0; mem = ver_mem_maybe[i]; i++)
+ds_printf(DS_LEV_VER, %s, mem);
+
+return 0;
 }
 
 static void outputVersion(void) {



-- System Information:
Debian Release: 7.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) (ignored: LC_ALL 
set to en_GB.UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages debsig-verify depends on:
ii  gnupg   1.4.12-7
ii  libc6   2.15-0ubuntu10.33.1
ii  libxmltok1  1.2-3

debsig-verify recommends no packages.

Versions of packages debsig-verify suggests:
ii  debian-keyring  2013.04.21

-- no debconf information