Skip to content
Snippets Groups Projects
Verified Commit 2e6e282d authored by Antoine R. Dumont's avatar Antoine R. Dumont
Browse files

nixguix: Deal with manifest entries without an integrity field

In that case, this fallbacks to use the "outputHash" which is an equivalent field of the
integrity one except it's for "recursive" outputHashMode. This adds the necessary
assertions around this case so correct data is sent to loaders as well.

Related to T3781
parent f2377c28
No related branches found
No related tags found
No related merge requests found
......@@ -16,6 +16,7 @@ Artifacts can be of types:
"""
import base64
import binascii
from dataclasses import dataclass
from enum import Enum
import logging
......@@ -362,11 +363,20 @@ class NixGuixLister(StatelessLister[PageResult]):
yield built_artifact
continue
outputHash = artifact.get("outputHash")
integrity = artifact.get("integrity")
if integrity is None:
logger.warning("Skipping url <%s>: missing integrity field", origin)
if integrity is None and outputHash is None:
logger.warning(
"Skipping url <%s>: missing integrity and outputHash field",
origin,
)
continue
# Falls back to outputHash field if integrity is missing
if integrity is None and outputHash:
# We'll deal with outputHash as integrity field
integrity = outputHash
try:
is_tar, origin = is_tarball(urls, self.session)
except ArtifactNatureMistyped:
......@@ -396,10 +406,18 @@ class NixGuixLister(StatelessLister[PageResult]):
# convert into a dict of checksums. This only parses the
# `hash-expression` (hash-<b64-encoded-checksum>) as defined in
# https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
chksum_algo, chksum_b64 = integrity.split("-")
checksums: Dict[str, str] = {
chksum_algo: base64.decodebytes(chksum_b64.encode()).hex()
}
try:
chksum_algo, chksum_b64 = integrity.split("-")
checksums: Dict[str, str] = {
chksum_algo: base64.decodebytes(chksum_b64.encode()).hex()
}
except binascii.Error:
logger.exception(
"Skipping url: <%s>: integrity computation failure for <%s>",
url,
artifact,
)
continue
# The 'outputHashMode' attribute determines how the hash is computed. It
# must be one of the following two values:
......
......@@ -27,6 +27,16 @@
],
"integrity": "sha256-lV3xiWUZmSnt4LW0ni/sUyC/bbtaxkTzvFLFtJKLuI4="
},
{
"outputHash": "sha256-9uF0fYl4Zz/Ia2UKx7CBi8ZU8jfWoBfy2QSgTSwXo5A",
"outputHashAlgo": null,
"outputHashMode": "recursive",
"type": "url",
"urls": [
"https://github.com/figiel/hosts/archive/v1.0.0.tar.gz"
],
"inferredFetcher": "fetchzip"
},
{
"type": "url",
"urls": [ "unknown://example.org/wrong-scheme-so-skipped.txt" ],
......
......@@ -79,6 +79,16 @@
"svn_url": "https://code.call-cc.org/svn/chicken-eggs/release/5/iset/tags/2.2",
"svn_revision": 39057
},
{
"outputHash": "sha256-LxVcYj2WKHbhNu5x/DFkxQPOYrVkNvwiE/qcODq52Lc=",
"outputHashAlgo": null,
"outputHashMode": "recursive",
"type": "url",
"urls": [
"https://github.com/julian-klode/triehash/archive/debian/0.3-3.tar.gz"
],
"inferredFetcher": "fetchzip"
},
{
"type": "url",
"urls": [
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment