[pbs-devel] [PATCH proxmox-apt] release-file: improve invalid file-reference handling

[pbs-devel] [PATCH proxmox-apt] release-file: improve invalid file-reference handling

[Fabian Grünbichler]

if we encounter a file reference pointing to a component that is not
contained in the componenents list, we can just ignore it as unknown.
only treat parsing errors for references pointing to known components as
actual errors.

this currently triggers with (In)Release files for debian-updates and
debian-security, which reference (empty) files for a "non-free-firmware"
component that is not listed in the `Components` field of the release
file.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 src/deb822/release_file.rs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/deb822/release_file.rs b/src/deb822/release_file.rs
index ee805bb..6068238 100644
--- a/src/deb822/release_file.rs
+++ b/src/deb822/release_file.rs
@@ -389,11 +389,16 @@ impl TryFrom<ReleaseFileRaw> for ReleaseFile {
             let (component, file_type) = components
                 .iter()
                 .find_map(|component| {
-                    FileReferenceType::parse(component, &file)
-                        .ok()
-                        .map(|file_type| (component.clone(), file_type))
+                    if !file.starts_with(&format!("{component}/")) {
+                        return None;
+                    }
+
+                    Some(
+                        FileReferenceType::parse(component, &file)
+                            .map(|file_type| (component.clone(), file_type)),
+                    )
                 })
-                .ok_or_else(|| format_err!("failed to parse file reference '{file}'"))?;
+                .unwrap_or_else(|| Ok(("UNKNOWN".to_string(), FileReferenceType::Unknown)))?;
 
             Ok((
                 FileReference {
-- 
2.30.2

[pbs-devel] applied: [PATCH proxmox-apt] release-file: improve invalid file-reference handling

[Wolfgang Bumiller]

applied

On Thu, Aug 04, 2022 at 11:43:50AM +0200, Fabian Grünbichler wrote:
> if we encounter a file reference pointing to a component that is not
> contained in the componenents list, we can just ignore it as unknown.
> only treat parsing errors for references pointing to known components as
> actual errors.
> 
> this currently triggers with (In)Release files for debian-updates and
> debian-security, which reference (empty) files for a "non-free-firmware"
> component that is not listed in the `Components` field of the release
> file.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
>  src/deb822/release_file.rs | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/src/deb822/release_file.rs b/src/deb822/release_file.rs
> index ee805bb..6068238 100644
> --- a/src/deb822/release_file.rs
> +++ b/src/deb822/release_file.rs
> @@ -389,11 +389,16 @@ impl TryFrom<ReleaseFileRaw> for ReleaseFile {
>              let (component, file_type) = components
>                  .iter()
>                  .find_map(|component| {
> -                    FileReferenceType::parse(component, &file)
> -                        .ok()
> -                        .map(|file_type| (component.clone(), file_type))
> +                    if !file.starts_with(&format!("{component}/")) {
> +                        return None;
> +                    }
> +
> +                    Some(
> +                        FileReferenceType::parse(component, &file)
> +                            .map(|file_type| (component.clone(), file_type)),
> +                    )
>                  })
> -                .ok_or_else(|| format_err!("failed to parse file reference '{file}'"))?;
> +                .unwrap_or_else(|| Ok(("UNKNOWN".to_string(), FileReferenceType::Unknown)))?;
>  
>              Ok((
>                  FileReference {
> -- 
> 2.30.2