mirror of
https://codeberg.org/guix/guix.git
synced 2026-09-05 21:31:37 +00:00
Reepca Russelstein
ed0a9721f8
Also validate that they are in strictly ascending order, which also ensures
that there are no duplicate names.
When 'guix substitute' fetches a nar, it does so with a validly-signed hash
already known from the narinfo. But it can't verify that the hash of the nar
it's currently fetching matches until the full nar is downloaded. Until then,
'download-nar' will extract the nar into the specified destination using
'restore-path', which avoids having to keep a file of unbounded size in
memory. Critically, this means that the input that 'restore-path' (and by
extension 'fold-archive') is processing is untrusted, since substitute server
TLS certificates aren't verified (the narinfo signatures are supposed to make
it unnecessary).
As such, the scope of harm that can be caused by a malicious nar being
processed by 'restore-file' needs to be minimized.
* guix/serialization.scm (valid-nar-file-name?): new procedure.
(fold-archive): Use it to verify that directory entry names do not contain
'/' or '\0', and they are not equal to ".", "..", or "". Also verify that
they are in strictly ascending order.
(call-with-port*): new procedure.
(dump-file): use O_EXCL and O_NOFOLLOW. This precaution ensures that even
if 'restore-file' is somehow tricked into writing to a symlink (not
currently believed to be possible), it will result in an error.
* guix/store/deduplication.scm (call-with-fresh-output-file): new procedure.
(dump-file/deduplicate): use it for similar reasons as 'dump-file'.
* tests/nar.scm (call-with-tree-port, port-bad-nar?): new procedures.
("write-file-tree + fold-archive, unsorted directory entries",
"write-file-tree + fold-archive, duplicate directory entries",
"write-file-tree + fold-archive, invalid directory entries"): new tests.
* tests/publish.scm (call-with-temporary-output-filename): new procedure.
("/nar/*", "/nar/gzip/*", "/nar/lzip/*", "/nar/zstd/*", "/nar/ with properly
encoded '+' sign"): use it in these test cases so that the output filename
doesn't name an already-existing file.
Change-Id: I41f248c13d7af787233afad5cae102056329a68b
Signed-off-by: Ludovic Courtès <ludo@gnu.org>