Groups > linux.debian.bugs.dist > #1253127

Bug#1109423: want dgit push-source --facilitate-xz-attack

Path	csiph.com!news.samoylyk.net!gothmog.csi.it!bofh.it!news.nic.it!robomod
From	Sean Whitton <spwhitton@spwhitton.name>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1109423: want dgit push-source --facilitate-xz-attack
Date	Fri, 18 Jul 2025 11:10:01 +0200
Message-ID	<L9Pgl-RfX-5@gated-at.bofh.it> (permalink)
References	<L9wno-ELa-9@gated-at.bofh.it> <L9wno-ELa-9@gated-at.bofh.it>
X-Mailbox-Line	From debian-bugs-dist-request@lists.debian.org Fri Jul 18 09:07:10 2025
Old-Return-Path	<debbugs@buxtehude.debian.org>
X-Spam-Flag	NO
X-Spam-Score	-3.999
Reply-To	Sean Whitton <spwhitton@spwhitton.name>, 1109423@bugs.debian.org
Resent-To	debian-bugs-dist@lists.debian.org
Resent-Cc	Debian tag2upload Delegates <dgit-owner@debian.org>
X-Debian-Pr-Message	followup 1109423
X-Debian-Pr-Package	dgit
X-Debian-Pr-Source	dgit
Feedback-ID	20115:3760:null:purelymail
X-Pm-Original-To	1109423@bugs.debian.org
User-Agent	Gnus/5.13 (Gnus v5.13)
MIME-Version	1.0
Content-Type	multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature"
X-Debian-Message	from BTS
X-Mailing-List	<debian-bugs-dist@lists.debian.org> archive/latest/1914191
List-ID	<debian-bugs-dist.lists.debian.org>
List-URL	<https://lists.debian.org/debian-bugs-dist/>
Approved	robomod@news.nic.it
Lines	62
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	1109423@bugs.debian.org
X-Original-Date	Fri, 18 Jul 2025 10:05:46 +0100
X-Original-Message-ID	<878qkl27it.fsf@zephyr.silentflame.com>
X-Original-References	<26744.61801.529730.455509@chiark.greenend.org.uk> <26744.61801.529730.455509@chiark.greenend.org.uk>
Xref	csiph.com linux.debian.bugs.dist:1253127

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello,

On Thu 17 Jul 2025 at 01:49pm +01, Ian Jackson wrote:

> Package: dgit
> Version: 13.5
>
> It has become clear to me in many corridor conversations that,
> workflows involving pristine-tar and upstream origs are really very
> common.  Where upstream origs are not treesame to git (which is
> basically, whenever they were not made by git-archive):
>
>  1. Existing non-git-first workflows (git-buildpackage) do not report
>     the discrepancy.  They treat the tarball as more authoritative.
>
>  2. dgit push-source will fail.  tag2upload will fail, even if
>     we implement pristine-tar support.
>
> Of course no-one should be using these workflows, but we need to think
> whether we would rather somehow dismantle this barrier to dgit/t2u
> adoption.  In practice I think the folks with the vulnerable workflow
> are going to keep with their vulnerable workflow anyway.
>
> The obvious way would be to reify the xz attack diff as an extra patch
> in d/patches, during git canonicalisation (as we do for .gitignore).

Interesting.  Doing it as an extra patch sounds good; it's easy to
inspect what was done.  The UI for turning this on for tag2upload seems
tricky unless we only add one additional quilt mode which is like --gbp
plus this.  Otherwise we need another [dgit ...] element.

Could it be on by default if the user is already using the foreseen
pristine-tar support?  I.e. we defer to their pristine-tar data.

-- 
Sean Whitton

Thread

Bug#1109423: want dgit push-source --facilitate-xz-attack Ian Jackson <ijackson@chiark.greenend.org.uk> - 2025-07-17 15:00 +0200
  Bug#1109423: want dgit push-source --facilitate-xz-attack Sean Whitton <spwhitton@spwhitton.name> - 2025-07-18 11:10 +0200
  Bug#1109423: want dgit push-source --facilitate-xz-attack Colin Watson <cjwatson@debian.org> - 2025-07-20 16:00 +0200
    Bug#1109423: want dgit push-source --facilitate-xz-attack Ian Jackson <ijackson@chiark.greenend.org.uk> - 2025-07-24 23:00 +0200

csiph-web