deltarpm usefulness?
by Marek Marczykowski-Górecki
Hi all,
I think deltarpm is not really useful anymore:
- there are very few drpm files in the repository, see for example:
https://download.fedoraproject.org/pub/fedora/linux/updates/34/Everything...
https://download.fedoraproject.org/pub/fedora/linux/updates/33/Everything...
- those that actually are there, are mostly about small packages anyway
- personally, I haven't seen it being used for a long time
- there is also argument that people's connection bandwidth nowadays
tends to be fast enough to make the package rebuilding actually
slower than downloading the whole package (but that really vary between
different installations)
- and most importantly: drpm files are - by design - processed before
checking the package signature, which exposes rather big attack
surface(*)
Can deltarpm be disabled by default? In the few cases where it's
actually useful (if there are any...), user is free to enable it, but
the default would be significantly more secure this way.
(*) it is integrity protected via a hash in the repository metadata, but
repository metadata in Fedora are still not signed - so this all heavily
depends on the integrity of the [HTTPS connection to]
mirrors.fedoraproject.org server (or any of CAs trusted by the system) -
a rather fragile single point of failure.
--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
2 years, 6 months
Automated formal verification of RPM packages
by Kamil Dudka
Formal verification of RPM packages with CBMC, Divine, and Symbiotic is now
easier than ever before! csmock plug-ins for these tools are now available
in stable Fedora releases. The plug-ins are still experimental and they have
some technical limitations:
- They work only for source RPM packages that contain the %check section
that directly or indirectly invokes the binaries produced in the %build
section.
- The tools are known to work reliably only for programs written in C.
- Only one formal verification tool can be enabled in one run of csmock.
- Only *-x86_64 build roots are supported for now.
- The fedora-rawhide-x86_64 build root is not supported at the moment.
The plug-ins can be installed on a Fedora system using the following command:
$ sudo dnf install csmock-plugin-{cbmc,divine,symbiotic}
Then you can formally verify RPM packages of your choice:
$ csmock -r fedora-35-x86_64 -t ${tool} ${pkg}.src.rpm
These plug-ins were developed as part of the AUFOVER (Automation of Formal
Verification) research project:
https://research.redhat.com/blog/research_project/aufover-2/
Some useful tips can be found on the aufover/experiments wiki:
https://github.com/aufover/experiments
If you run into any issues please do not hesitate to reach out to us.
We welcome any feedback you may have as it will help us make further
improvements to the tools.
Kamil and the AUFOVER team
2 years, 6 months
dnf "no match for group package" on upgrade...
by Matthew Miller
I'm seeing a number of people confused by this message, usually followed by
some actual transaction error.
I _think_ this is happening because these packages are in comps but do not
exist in the distro. Is this correct? I tried to search for it, but the
error message is _very_ common in ... well, people who are asking about it
because of what I said. (For example: https://unix.stackexchange.com/q/542877/2511)
I found https://bugzilla.redhat.com/show_bug.cgi?id=1538346 but not much of
a general resolution. It does note that one issue is arch-specific
packages (which maybe just need "arch=..." in comps?).
I think we should:
1. Have a schedule standarded task to remove any packages listed but
non-existent after branch from rawhide. (I assume a Rel-Eng task?)
2. Have DNF make this message less scary. Maybe even move down to a debug
message and not show it by default — I am not seeing a situation where
they're useful to _most_ end-users.
Anything I'm missing?
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
2 years, 6 months
Schedule for Monday's FESCo Meeting (2021-11-08)
by Zbigniew Jędrzejewski-Szmek
[Note the DST change in many places: the meeting may move up one hour for you.]
Following is the list of topics that will be discussed in the
FESCo meeting Monday at 19:00UTC in #fedora-meeting on
irc.libera.chat.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/UTCHowto
or run:
date -d '2021-11-08 19:00 UTC'
Links to all issues to be discussed can be found at:
https://pagure.io/fesco/report/meeting_agenda
= Discussed and Voted in the Ticket =
#2681 F36 Change: Ansible 5
https://pagure.io/fesco/issue/2681
APPROVED (+5,1,-0)
#2680 F36 Change: Enforce Authselect Configuration Consistency
https://pagure.io/fesco/issue/2680
APPROVED (+2,0,-0)
#2675 Nonresponsive maintainer: Paul Gier pgier
https://pagure.io/fesco/issue/2675
APPROVED (+2, 0, -0)
= Followups =
= New business =
#2682 F36 Change: Openldap-2.5
https://pagure.io/fesco/issue/2682
#2684 F36 Change: Drop NIS(+) support from PAM
https://pagure.io/fesco/issue/2684
#2687 F36 Change: Package information on ELF objects
https://pagure.io/fesco/issue/2687
= Open Floor =
For more complete details, please visit each individual
issue. The report of the agenda items can be found at
https://pagure.io/fesco/report/meeting_agenda
If you would like to add something to this agenda, you can
reply to this e-mail, file a new issue at
https://pagure.io/fesco, e-mail me directly, or bring it
up at the end of the meeting, during the open floor topic. Note
that added topics may be deferred until the following meeting.
2 years, 6 months
