[Git][reproducible-builds/strip-nondeterminism][debian] 7 commits: Catch an edge-case where we can't even parse the provided length of an invalid...

Chris Lamb gitlab at salsa.debian.org
Sun Apr 28 18:31:24 CEST 2019



Chris Lamb pushed to branch debian at Reproducible Builds / strip-nondeterminism


Commits:
783d44e3 by Chris Lamb at 2019-04-28T09:17:11Z
Catch an edge-case where we can't even parse the provided length of an invalid field within zip files.

- - - - -
b164403e by Chris Lamb at 2019-04-28T09:20:12Z
Check the return status from Archive::Zip when writing file to disk.

- - - - -
f40f5550 by Chris Lamb at 2019-04-28T09:54:40Z
Workaround Archive::Zip's incorrect handling of the localExtraField field by monkey-patching the accessor methods to always return normalised values. This fixes the normalisation of Unix ownership (uid/gid) within .zip archives, .epub files, etc. (Closes: #858431, reproducible-builds/strip-nondeterminism#4)

- - - - -
e6b1d81b by Chris Lamb at 2019-04-28T16:25:51Z
Release version 1.1.3

- - - - -
48be1d06 by Chris Lamb at 2019-04-28T16:26:07Z
Merge tag '1.1.3' into debian

Release version 1.1.3

* tag '1.1.3':
  Release version 1.1.3
  Workaround Archive::Zip's incorrect handling of the localExtraField field by monkey-patching the accessor methods to always return normalised values. This fixes the normalisation of Unix ownership (uid/gid) within .zip archives, .epub files, etc. (Closes: #858431, reproducible-builds/strip-nondeterminism#4)
  Check the return status from Archive::Zip when writing file to disk.
  Catch an edge-case where we can't even parse the provided length of an invalid field within zip files.

- - - - -
85255a1a by Chris Lamb at 2019-04-28T16:30:19Z
Add libmonkey-patch-perl as a binary / build dependency.

- - - - -
6b532938 by Chris Lamb at 2019-04-28T16:30:33Z
Update changelog for 1.1.3-1 release

- - - - -


5 changed files:

- Makefile.PL
- debian/changelog
- debian/control
- lib/File/StripNondeterminism.pm
- lib/File/StripNondeterminism/handlers/zip.pm


Changes:

=====================================
Makefile.PL
=====================================
@@ -17,6 +17,7 @@ WriteMakefile(
 		'Archive::Cpio'	=> 0, # required to pass tests
 		'Archive::Zip'	=> 0,
 		'Getopt::Long'	=> 0,
+		'Monkey::Patch'	=> 0,
 	},
 	LICENSE		=> "gpl",
 	dist		=> { COMPRESS => 'gzip -9nf', SUFFIX => 'gz', },


=====================================
debian/changelog
=====================================
@@ -1,3 +1,16 @@
+strip-nondeterminism (1.1.3-1) experimental; urgency=medium
+
+  * Workaround Archive::Zip's incorrect handling of the localExtraField field
+    by monkey-patching the accessor methods to always return normalised values.
+    This fixes the normalisation of Unix ownership (uid/gid) within .zip
+    archives, .epub files, etc.
+    (Closes: #858431, reproducible-builds/strip-nondeterminism#4)
+  * Check the return status from Archive::Zip when writing file to disk.
+  * Catch an edgecase where/if we can't parse the provided length of an
+    invalid field within .zip files.
+
+ -- Chris Lamb <lamby at debian.org>  Sun, 28 Apr 2019 17:30:27 +0100
+
 strip-nondeterminism (1.1.2-1) unstable; urgency=medium
 
   * Call file(1) with the "--" argument placeholder to fix normalisation of


=====================================
debian/control
=====================================
@@ -8,6 +8,7 @@ Build-Depends-Indep:
  libarchive-cpio-perl <!nocheck>,
  libarchive-zip-perl,
  libdevel-cover-perl,
+ libmonkey-patch-perl,
  perl,
 Maintainer: Reproducible builds folks <reproducible-builds at lists.alioth.debian.org>
 Uploaders:
@@ -26,6 +27,7 @@ Section: perl
 Architecture: all
 Depends:
  libarchive-zip-perl,
+ libmonkey-patch-perl,
  ${misc:Depends},
  ${perl:Depends},
 Recommends:


=====================================
lib/File/StripNondeterminism.pm
=====================================
@@ -25,7 +25,7 @@ use POSIX qw(tzset);
 
 our($VERSION, $canonical_time, $clamp_time);
 
-$VERSION = '1.1.2'; # <https://semver.org/>
+$VERSION = '1.1.3'; # <https://semver.org/>
 
 sub init() {
 	$ENV{'TZ'} = 'UTC';


=====================================
lib/File/StripNondeterminism/handlers/zip.pm
=====================================
@@ -24,6 +24,7 @@ use warnings;
 use File::Temp;
 use File::StripNondeterminism;
 use Archive::Zip qw/:CONSTANTS :ERROR_CODES/;
+use Monkey::Patch qw/patch_class/;
 
 # A magic number from Archive::Zip for the earliest timestamp that
 # can be represented by a Zip file.  From the Archive::Zip source:
@@ -145,6 +146,10 @@ sub normalize_extra_fields($$) {
 		} else {
 			# Catch invalid field lengths by calculating whether we would
 			# read beyond the end of the file.
+			if (!defined($len)) {
+				warn "strip-nondeterminism: unknown extra field length";
+				return;
+			}
 			if ($pos + $len >= length($field)) {
 				warn "strip-nondeterminism: invalid extra field length ($len)";
 				return;
@@ -213,14 +218,34 @@ sub normalize {
 				? oct(755)
 				: oct(644));
 		}
-		foreach my $x (qw(cdExtraField localExtraField)) {
-			my $result = normalize_extra_fields($canonical_time, $member->$x);
-			return 0 unless defined $result;
-			$member->$x($result);
-		}
 	}
 	my $old_perms = (stat($zip_filename))[2] & oct(7777);
-	$zip->overwrite();
+
+	# Archive::Zip::Member does not handle the localExtraField field (used for
+	# uid/gids) correctly or consistently.
+	#
+	# It does not populate localExtraField in the class upon initial reading of
+	# the file whilst it does for cdExtraField. One can workaround this
+	# manually with calls to _seekToLocalHeader and _readLocalFileHeader but
+	# upon writing to a file back to the disk Archive::Zip will ignore any
+	# stored value of localExtraField (!) and reload it again from the existing
+	# file handle in/around rewindData.
+	#
+	# We therefore monkey-patch the accessor methods of the Member class to
+	# ensure that normalised values are used in this final save.
+	#
+	# <https://salsa.debian.org/reproducible-builds/strip-nondeterminism/issues/4>
+	my @patches = map {
+		patch_class('Archive::Zip::Member', $_, sub {
+			my $fn = shift;
+			my $result = $fn->(@_);
+			return defined($result) ?
+				normalize_extra_fields($canonical_time, $result) : $result;
+		});
+	} qw(cdExtraField localExtraField);
+
+	return 0 unless $zip->overwrite() == AZ_OK;
+	undef @patches; # Remove our monkey patches
 	chmod($old_perms, $zip_filename);
 	return 1;
 }



View it on GitLab: https://salsa.debian.org/reproducible-builds/strip-nondeterminism/compare/b9f7ff12933e6bc0f5801940702d3c6e99dd69ab...6b532938556dabae5d17be902d3332a8034adf60

-- 
View it on GitLab: https://salsa.debian.org/reproducible-builds/strip-nondeterminism/compare/b9f7ff12933e6bc0f5801940702d3c6e99dd69ab...6b532938556dabae5d17be902d3332a8034adf60
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20190428/19a01ca0/attachment.html>


More information about the rb-commits mailing list