Date: Mon, 22 Oct 2018 20:26:38 +0200 From: Jakub Wilk <jwilk@...lk.net> To: oss-security@...ts.openwall.com Subject: Re: Using quilt on untrusted RPM spec files * Matthias Gerstner <mgerstner@...e.de>, 2018-09-27, 17:59: >It turns out that running `quilt setup` on untrusted sources is not a >good idea: Debian largely avoids this problem by having a source package format with built-in patch system. Most of the time the unpacked source package will have patches applied, so there's no need for the reviewer to run untrusted code to prepare the source. (That said, dpkg-source had quite a few path traversal bugs in the past and I have a hunch there's more to be found...) While debian/rules can have optional "patch" target (which is a bit like RPM's %prep), it felt to disuse these days. A developer wouldn't call "debian/rules patch" against a random not-yet-reviewed package, because it would be unusual to have this target implemented.  https://manpages.debian.org/stretch/dpkg-dev/dpkg-source.1.en.html#Format:_3.0_%28quilt%29  https://security-tracker.debian.org/tracker/source-package/dpkg  https://www.debian.org/doc/debian-policy/ch-source.html#main-building-script-debian-rules -- Jakub Wilk
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.