refresh_package_versions() must skip binary blobs in debian/

Bug #1453846 reported by Barry Warsaw
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
CI Train [cu2d]
Fix Released
High
Łukasz Zemczak

Bug Description

system-image has a binary blob in its debian/ directory, specifically the archive-master.tar.xz keyring.

in packagemanager.py, refresh_package_versions(), it globs debian/* and then tries to open every file found there in utf-8 mode to do a version replacement. This fails on debian/archive-master.tar.xz (probably - it's hard to tell from the traceback, but it's the only candidate):

https://ci-train.ubuntu.com/job/ubuntu-landing-011-1-build/148/console

Two options that I see, one easy, one harder.

The easy option: just catch any UnicodeDecodeError that happens while reading data out of utf8_inplace(path), and assume the file is binary, so just skip it.

The problem with that is that you could potentially do a harmful string replacement in a binary blob that's accidentally utf-8 compatible.

The hard option: either whitelist the files in debian/* that you want to do the replace of (rather than just the glob of everything in debian/*) or find a way to blacklist certain files. The latter probably requires the package being built to specify that in some way, though I don't know where that would be (a d/control header? some magic debian/* file?). Besides, it's probably safer to whitelist anyway.

Related branches

Changed in cupstream2distro:
status: New → In Progress
assignee: nobody → Łukasz Zemczak (sil2100)
importance: Undecided → High
Revision history for this message
PS Jenkins bot (ps-jenkins) wrote :

Fix committed into lp:cupstream2distro at revision 980, scheduled for release in cupstream2distro, milestone Unknown

Changed in cupstream2distro:
status: In Progress → Fix Committed
Changed in cupstream2distro:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.