aboutsummaryrefslogtreecommitdiffstats
path: root/src/archive.c
Commit message (Collapse)AuthorAgeFilesLines
* add support for openssl 1.1Timo Teräs2018-10-261-7/+10
|
* rework unpacking of packages and harden package file format requirementsTimo Teräs2018-09-101-21/+13
| | | | | | | | | | | | | | | | | | | A crafted .apk file could to trick apk writing unverified data to an unexpected file during temporary file creation due to bugs in handling long link target name and the way a regular file is extracted. Several hardening steps are implemented to avoid this: - the temporary file is now always first unlinked (apk thus reserved all filenames .apk.* to be it's working files) - the temporary file is after that created with O_EXCL to avoid races - the temporary file is no longer directly the archive entry name and thus directly controlled by potentially untrusted data - long file names and link target names are now rejected - hard link targets are now more rigorously checked - various additional checks added for the extraction process to error out early in case of malformed (or old legacy) file Reported-by: Max Justicz <max@justi.cz>
* archive: enable FIFO extractionJesse Young2018-08-141-2/+4
|
* fix comparison of unsigned expression < 0 is always falseDmitry Golovin2017-08-231-1/+2
| | | | found by clang
* tar: use standard header prefixTimo Teräs2017-06-261-1/+9
| | | | | | | APKs have been created with GNU tar so far, which uses the GNU extensions for long names. In order to increase portability support the standard header's 'prefix' portion in case the GNU extensions are not present.
* io: make io vtables const struct, and add accessors for themTimo Teräs2017-06-231-13/+17
| | | | | This reduces function pointers in heap, and unifies how the io functions are called.
* archive: validate reading of pax and gnu long filename extensionsTimo Teräs2017-06-231-14/+14
| | | | | | | Detect properly if the file stream gets an error during these read operations. Reported-by: Ariel Zelivansky from Twistlock
* archive: fix incorrect bounds checking for memory allocationTimo Teräs2017-06-231-2/+4
| | | | | | | | | | | The value from tar header is unsigned int; keep it casted to unsigned int and size_t instead of (signed) int, otherwise the comparisons fail to do their job properly. Additionally check entry.size against SSIZE_MAX so the rounding up later on is guaranteed to not overflow. Fixes CVE-2017-9669 and CVE-2017-9671. Reported-by: Ariel Zelivansky from Twistlock
* tar: return correct error for short read of tar archiveTimo Teräs2017-01-051-3/+8
|
* archive: fix long symlink target namesTimo Teräs2016-02-091-2/+2
| | | | | don't overwrite the link_target if it was found from pax header. ref #5076
* io, database: preserve [am]time for cached and fetched filesTimo Teräs2015-11-091-0/+13
| | | | | | | | | | | preserve [am]time for all packages and indexes. this fixes the caching error that 'apk update' is after new index is generated, but before the used mirror is synchronized. this caused local apkindex timestamp to be newer than file in mirror, when in fact it was outdated index. this also fixes fetched files to have build timestamp so that files going to .iso or custom images have proper timestamps (rsync with appropriate --modify-window now works)
* fix issue introduced in previous xattr error handling changesTimo Teräs2015-04-171-2/+2
|
* disable xattrs on symlinks for nowTimo Teräs2015-04-171-1/+1
| | | | | | there's no nice syscall to manipulate xattrs with atfd and or open the symlink without dereferencing it (and having fd that we can do xattrs with)
* make file install errors non-fatal, and xattr errors hiddenTimo Teräs2015-04-171-53/+58
| | | | | | | | | user xattrs on tmpfs are not supported no non-grsec kernels, and many times root fs is mounted without user_xattr. Thus to allow things to go smoothly on non-grsec kernels xattr unsupported errors are now hidden. xattrs can be fixed still now with "apk fix --xattrs"
* calculate and store checksum of xattrsTimo Teräs2015-03-111-1/+4
| | | | ref #3027
* rename file info related functions for consistencyTimo Teräs2015-03-101-2/+2
|
* extract xattrs from packagesTimo Teräs2015-03-101-0/+33
| | | | ref #3027
* support extended pax header in tar extractorTimo Teräs2014-11-011-38/+83
|
* archive: fix handling of name lengths of exactly 100 bytesTimo Teräs2013-09-201-0/+3
|
* various: applet help text and comment fixesDubiousjim2013-06-281-1/+1
| | | | Acked-by: Natanael Copa <ncopa@alpinelinux.org>
* io: get rid of APK_PROGRESS_SCALETimo Teräs2013-06-171-2/+1
| | | | | no need to muldiv all the time, just pass the current amount of bytes done, and let callbacks use that directly.
* *.c: malloc.h->stdlib.hPierre Carrier2013-04-181-1/+1
|
* all: update copyright year statementTimo Teräs2011-09-131-1/+1
|
* io, db: id cache should be specific to database root, not system rootTimo Teräs2010-10-081-3/+3
| | | | | Otherwise we end up using wrong uid/gid mappings when doing install to alternate system root. Fixes #434.
* archive: resolve uid, gid for file informationTimo Teräs2010-09-231-6/+3
| | | | | the uid and gid are used in other places than just changing file ownership on extraction.
* Fix building on eglibcNatanael Copa2010-08-301-0/+1
| | | | Seems like recent eglibc requires that you include sys/stat.h
* archive: honor username/groupname instead of uid/gidTimo Teräs2010-06-121-1/+4
| | | | Take the uid/gid from passwd and group.
* various: use O_CLOEXEC and add some error checkingTimo Teräs2010-06-111-1/+1
|
* First steps for libapkNatanael Copa2010-06-111-0/+1
|
* apk: remove the unneeded --never-overwriteTimo Teras2009-12-211-18/+1
| | | | | turns out the logic does not work with overlays as expected due to busybox symlinks being unmanaged. remove the useless option.
* archive: overwrite protection needs to use real filenameTimo Teras2009-11-061-1/+7
| | | | | otherwise we always extract the file as .apk-new and the database side just overwrites.
* apk: add --never-overwrite flag (ref #197)Timo Teras2009-11-061-2/+20
| | | | | | | to never ever overwrite a while in the filesystem the user knows about. it gives the impression of extraction succeeding even though nothing was done. this is inteded to be used only for bootstrapping with overlay.
* index, version: support for repository descriptions (fixes #141)Timo Teras2009-09-031-1/+2
| | | | | ability embed description information to repository indexes (e.g. repository name and version) and show it via "apk version -I".
* archive: update for new place of checksum in tar headerTimo Teras2009-08-111-9/+26
| | | | and take checksums for symlinks too.
* db, audit: audit symlinks (by hash of the link target)Timo Teras2009-08-111-1/+1
|
* archive: compile fixNatanael Copa2009-08-031-0/+1
| | | | We need the define for uint16
* apk: use *at instead of chdir+normal file syscallTimo Teras2009-07-311-26/+29
| | | | | | | | this way we never change cwd, and relative filenames are always parsed consistently. this also helps filename construction in many places. this patch also changes '--root' to override location of all configuration to be in the new root. previously it depended on the file which one was used.
* io: fix mmap writing to actually workTimo Teras2009-07-301-1/+1
| | | | | | | apparently it needs to have both PROT_READ and PROT_WRITE. and it needs to be MAP_SHARED for the writing to be effective. oh, and the data needs to be preallocated with ftruncate; otherwise, one gets SIGBUS.
* tar: make checksumming of inner files conditionalTimo Teras2009-07-291-4/+7
| | | | | and force checksumming only when unpacking archive. otherwise it's extra computation for nothing.
* tar: don't call digest finalization twiceTimo Teras2009-07-291-0/+3
| | | | | otherwise bad things happens. avoid this be checking end of stream at the beginning of read.
* archive: append .apk-new to hard link targetsNatanael Copa2009-07-231-1/+5
| | | | Otherwise will link(2) fail since it does not exist.
* various: more informative error messagesTimo Teras2009-07-221-10/+11
|
* various: installation fixesTimo Teras2009-07-221-1/+2
| | | | | | | | - extract everything as .apk-new and overwrite only after data has been checksummed - url construction fixes (to work with simple http servers) - end of gunzip stream fixed - remove oneshot digesting flag for now as it's usage was broken
* various: fix installation of new style apksTimo Teras2009-07-211-1/+1
|
* pkg: fix indexing of multi-part apksTimo Teras2009-07-211-3/+3
|
* db: fixes to package checksumming while installing itTimo Teras2009-07-211-7/+12
|
* db: signed index loading (ref #46)Timo Teras2009-07-201-0/+5
| | | | prefer index in the new format as signed .tar.gz.
* archive: use the abuild-tar mangled checksum if availableTimo Teras2009-07-161-8/+28
| | | | to speed up apk installation avoid calculating checksums.
* various: new style index generationTimo Teras2009-07-161-12/+27
| | | | | | change the index generation to do old index, or the new style index where package identity is sha1 of control block and it's contained within an .tar.gz to allow signing in future.
* gzip: always autoclose the inner streamTimo Teras2009-07-161-13/+0
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-07 10:41:09 +0000