After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 725924 - pull: delete temp files if they appear corrupted
pull: delete temp files if they appear corrupted
Status: RESOLVED FIXED
Product: ostree
Classification: Infrastructure
Component: general
unspecified
Other Linux
: Normal normal
: ---
Assigned To: OSTree maintainer(s)
OSTree maintainer(s)
Depends on:
Blocks:
 
 
Reported: 2014-03-07 23:03 UTC by Colin Walters
Modified: 2014-03-09 14:59 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
pull: Ensure temporary data that appears corrupted is deleted (5.47 KB, patch)
2014-03-08 00:35 UTC, Colin Walters 		committed Details | Review

Description Colin Walters 2014-03-07 23:03:29 UTC 
Ok done, I have your proxy.pl running.  All I see is:

error: File header size 963000419 exceeds size 130

Which is pretty much expected since we're returning corrupted GVariant data.  

Ok, right I see, it looks like then after removing the proxy, further upgrades continuously fail since we're trying to work on top of the partially fetched object.

This is a little tricky to fix because the whole point of saving the temp file is to resume partial downloads if we were interrupted, so I need to distinguish between "temp file is corrupted" versus "download was interrupted".
Comment 1 Colin Walters 2014-03-08 00:35:37 UTC 
Created attachment 271289 [details] [review]
pull: Ensure temporary data that appears corrupted is deleted

If a MITM attacker (or just network corruption) causes a temporary
downloaded object in tmp/ to be corrupted, we'll end up
continually trying to commit it, and fail.

Fix this unlinking the temp file immediately after opening it.  This
will ensure that if we exit due to an error (or crash), the kernel
will clean up the space for us.
Comment 3 Jasper St. Pierre (not reading bugmail) 2014-03-08 20:07:48 UTC 
Review of attachment 271289 [details] [review]:

OK.
Comment 4 Colin Walters 2014-03-09 14:59:21 UTC 
Attachment 271289 [details] pushed as c2123bf - pull: Ensure temporary data that appears corrupted is deleted