aboutsummaryrefslogtreecommitdiffstats
path: root/src/database.c
Commit message (Collapse)AuthorAgeFilesLines
* document mysterious SHA-1 blob in database.cReid Rankin2020-01-251-0/+2
|
* db: additional clean up and hardening for apk extractionTimo Teräs2020-01-241-15/+16
| | | | | | | | This enforces all scripts to be in the control block, and all data files to be in data block. Ignoring of dot files in root is added back: packages without any real files will ship one ".dummy" item in the data block to trigger processing and validation to work.
* Harden signature verification processReid Rankin2020-01-241-15/+13
| | | | | | | | | | This mostly boils down to making sure control_started and data_started are consistently used to gate actions, instead of relying whether on file names start with a '.'. None of the weaknesses this fixes are exploitable, but they might have become so after changes to seemingly-unrelated code, so it's good to clean them up.
* archive: make apk_tar_parse check and close input streamTimo Teräs2020-01-111-19/+7
| | | | simplifies other code quite a bit
* convert remaining locations to use istream instead of bstreamTimo Teräs2020-01-111-25/+17
|
* istream, archive, db: convert db and tar function to use istreamTimo Teräs2020-01-111-51/+34
|
* archive: remove support for old packages without xattr checksumsTimo Teräs2020-01-111-4/+9
|
* database.c: drop GNU extension for fnmatchDrew DeVault2020-01-091-1/+1
| | | | The non-wildcard version of the function is case-sensitive anyway.
* io: remove unused size parameter from bstream closeTimo Teräs2020-01-061-5/+5
|
* db: parse tabulator as repository separator charTimo Teräs2019-12-271-0/+1
| | | | Fixes #10662
* Don't unpack files to system rootFredrik Gustafsson2019-11-221-1/+5
| | | | | | | | | When unpacking a file that is in root, it got a temporary file name /.apk... however if the --root option was used it should have the name root/.apk... otherwise unpacking will fail if the user does not have write access to /. Signed-off-by: Fredrik Gustafsson <fredrigu@axis.com>
* use fixed system time in test mode to have fixed test outputTimo Teräs2019-06-031-2/+2
| | | | fixes test suite regression from previous commit
* fix strncpy bounds errorsTimo Teräs2019-02-131-1/+4
| | | | | | error: 'strncpy' specified bound 4096 equals destination size [-Werror=stringop-truncation] Based on patch by Elan Ruusamäe <glen@delfi.ee>
* include sys/sysmacros.h for makedev definitionElan Ruusamäe2019-02-131-0/+1
|
* prefer selecting packages by their primary nameTimo Teräs2018-11-121-0/+8
|
* add support for openssl 1.1Timo Teräs2018-10-261-7/+12
|
* rework unpacking of packages and harden package file format requirementsTimo Teräs2018-09-101-53/+107
| | | | | | | | | | | | | | | | | | | A crafted .apk file could to trick apk writing unverified data to an unexpected file during temporary file creation due to bugs in handling long link target name and the way a regular file is extracted. Several hardening steps are implemented to avoid this: - the temporary file is now always first unlinked (apk thus reserved all filenames .apk.* to be it's working files) - the temporary file is after that created with O_EXCL to avoid races - the temporary file is no longer directly the archive entry name and thus directly controlled by potentially untrusted data - long file names and link target names are now rejected - hard link targets are now more rigorously checked - various additional checks added for the extraction process to error out early in case of malformed (or old legacy) file Reported-by: Max Justicz <max@justi.cz>
* prevent automatic repository index update with --no-networkNatanael Copa2018-08-211-1/+2
| | | | | | We should not update repository index when --no-network is specified. ref #9126
* prevent automatic repository index update for 'apk del'Timo Teräs2018-07-181-2/+4
| | | | ref #9063
* db: fix refreshing index if time is zeroTimo Teräs2018-04-051-3/+5
| | | | | | During netboot on systems without RTC, time() will be near zero, and the index fill not exist. Thus the plain test of st.st_mtime against system time failed. Verify that fstatat() succeeds.
* auto-update index only when database is opened for writingTimo Teräs2018-01-081-1/+2
|
* enable automatic update of indexes controlled by --cache-max-ageTimo Teräs2018-01-041-18/+25
| | | | | | | | | | | | | | | | This modifies apk cache for indexes to be automatically refreshed periodically without explicit 'update' or '--update-cache' usage. The default is to do if-modified-since request if the local copy is older than 4 hours. This age can be changed with --cache-max-age. Using --update-cache will change this age to 60 seconds to make sure the cached copy is relatively new. The small age is in order to try to avoid downloading indexes second time when apk-tools is upgraded and apk re-execs after self-upgrade. Accordingly using explicitly 'apk update' will now enforce --force-refresh and request the very latest index by requesting any potential http proxy to do refresh too.
* split --force to several --force-[type] optionsTimo Teräs2018-01-031-6/+6
| | | | | | | | | This unloads --force as several of the things are really not wanted together. E.g. --force-refresh is a lot different from --force-broken-world and doing --force to get the other might introduce unwanted behaviour. --force is still kept for backwards compatibility and it enables most things --force was used for.
* db: fix triggers to report deleted directoriesTimo Teräs2018-01-031-16/+19
| | | | | | | | | This change just changes to keep deleted directory items in the hash with ref count zero and modified flag set. Those entries are reused when needed. The side effect is that fire_triggers() will now see those removed direcotries and reports them. Other enumerators of the directories hash are protected to skip removed directories when appropriate.
* db: handle default root correctly for /procTimo Teräs2017-10-101-1/+1
| | | | | | dbopts->root may be null; use db->root instead fixes #7162
* database: include POSIX header for ST_* definesA. Wilcox2017-07-291-0/+1
|
* db: fix current directory instance caching in tar extractionTimo Teräs2017-06-261-1/+1
| | | | | | | Depending how the directory entries are ordered, the cached dir instance might not have been updated correctly. This has not been a problem as the entries have been ordered, but is now triggered on ppc.
* database: mark error on renameat failureA. Wilcox2017-06-261-2/+6
|
* io: make io vtables const struct, and add accessors for themTimo Teräs2017-06-231-26/+26
| | | | | This reduces function pointers in heap, and unifies how the io functions are called.
* db: fix regression preventing remounting apk cache r/wTimo Teräs2017-05-251-1/+2
| | | | | Introduced in commit c0f2d88f342f4d185f3991f98b79ab61a03896e4. fstatfs is needed to inspect the mount flags.
* db: separate init from openKaarle Ritvanen2017-04-281-11/+15
|
* db: catch asprintf failureNatanael Copa2017-03-131-1/+2
|
* db: prevent umount /proc when it was mounted by someone elseNatanael Copa2017-03-131-1/+6
| | | | This fixes regression introduced by commit 72b878e655
* db: allow overriding cache locationTimo Teräs2017-02-271-7/+7
|
* db: allow caching packages on tmpfsTimo Teräs2017-02-271-3/+1
| | | | | | | | | | fixes #5616 The original intention was not use unnecessary space on tmpfs e.g. if the cache directory is a mount point, but accidentally left unmounted. But there are valid cases when packages are intentionally wanted to be cached on tmpfs. If caching is not desired, the user can just remove the cache directory.
* db: mount /proc for --root if it's not mounted, use mount syscallTimo Teräs2017-02-271-34/+46
| | | | | musl c-library does not work properly without /proc, and potentially running the scripts need this.
* add support for pre and post commit hooksHenrik Riomar2017-02-151-0/+29
| | | | | | | This allows for instance integration of etckeeper [TT: Reorganized code a bit, and modified to use single directory commit_hooks.d with argument for script of stage.]
* db: add support for --no-cacheNatanael Copa2015-12-071-1/+7
| | | | | | | | | Implement --no-cache. The index is read directly from network and not cached. This is useful for docker, where you install a set of packages and directly after purge the cache. (see https://github.com/gliderlabs/docker-alpine/blob/1fc9e59d1689fc4eaf930ec66389fe58062fccec/builder/scripts/apk-install) fixes #4905
* io, database: preserve [am]time for cached and fetched filesTimo Teräs2015-11-091-0/+3
| | | | | | | | | | | preserve [am]time for all packages and indexes. this fixes the caching error that 'apk update' is after new index is generated, but before the used mirror is synchronized. this caused local apkindex timestamp to be newer than file in mirror, when in fact it was outdated index. this also fixes fetched files to have build timestamp so that files going to .iso or custom images have proper timestamps (rsync with appropriate --modify-window now works)
* db: stop extract more files if disk is fullTimo Teräs2015-09-031-2/+4
|
* relocate lock file to /lib/apk/dbTimo Teräs2015-07-021-3/+2
| | | | | | the problem is that var/lock is on root installs symlink to /run/lock (on tmpfs) and does not exist if doing chroot() to that root. fixes apk to work when chrooted to existing rootfs install.
* remove db dir entry properly, so it can be recreated properly if neededTimo Teräs2015-06-261-7/+7
| | | | fixes #4261
* for completeness free all arrays before exitTimo Teräs2015-06-121-0/+1
| | | | so valgrind does not report any leaks
* speed improvements for database openingTimo Teräs2015-06-111-4/+43
| | | | | | | | resolve reverse dependencies after all packages have been loaded, and avoid traversing the reverse name lists. now that we use automatic virtual packages (soname, pkg-config, etc.) the reverse dependency chains can become considerable longer than what it was when the rdependency construction code was originally written.
* fix directory permissions loadingTimo Teräs2015-06-011-1/+4
| | | | | commit 941fc1b1 uncovered a bug that directory permissions are not updated properly at db load time if it's the default acl.
* do not extract files with malicious nameTimo Teräs2015-04-241-1/+14
| | | | | | | | | the security implications are not as high as compared to regular tar/unzip archiver. this is because you are anyway trusting the package to install files anywhere in the filesystem. this serves rather as a sanity to check against errors in created package.
* modifications for the previous commit in error message handlingTimo Teräs2015-04-241-0/+2
| | | | forgot to --amend my changes
* make file install errors non-fatal, and xattr errors hiddenTimo Teräs2015-04-171-28/+41
| | | | | | | | | user xattrs on tmpfs are not supported no non-grsec kernels, and many times root fs is mounted without user_xattr. Thus to allow things to go smoothly on non-grsec kernels xattr unsupported errors are now hidden. xattrs can be fixed still now with "apk fix --xattrs"
* fix tee io error handlingTimo Teräs2015-04-131-1/+1
| | | | use ERR_PTR mechanism, and handle it at all places.
* make default dir/file acl implicitTimo Teräs2015-04-081-2/+2
| | | | | apk in alpine 3.1 already supports this optimization, but kept the database format. now is time to start using this feature.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-23 07:20:31 +0000