[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181022182638.uja7q6jhxn5md36n@jwilk.net>
Date: Mon, 22 Oct 2018 20:26:38 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: Using quilt on untrusted RPM spec files
* Matthias Gerstner <mgerstner@...e.de>, 2018-09-27, 17:59:
>It turns out that running `quilt setup` on untrusted sources is not a
>good idea:
Debian largely avoids this problem by having a source package format
with built-in patch system[0]. Most of the time the unpacked source
package will have patches applied, so there's no need for the reviewer
to run untrusted code to prepare the source.
(That said, dpkg-source had quite a few path traversal bugs in the
past[1] and I have a hunch there's more to be found...)
While debian/rules can have optional "patch" target[2] (which is a bit
like RPM's %prep), it felt to disuse these days. A developer wouldn't
call "debian/rules patch" against a random not-yet-reviewed package,
because it would be unusual to have this target implemented.
[0] https://manpages.debian.org/stretch/dpkg-dev/dpkg-source.1.en.html#Format:_3.0_%28quilt%29
[1] https://security-tracker.debian.org/tracker/source-package/dpkg
[2] https://www.debian.org/doc/debian-policy/ch-source.html#main-building-script-debian-rules
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
