[lkml]   [2003]   [Mar]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Deprecating .gz format on
Hash: SHA1

On Fri, 21 Mar 2003, Ville Herva wrote:

> On Thu, Mar 20, 2003 at 06:14:53PM -0500, you [Hank Leininger] wrote:
> >
> > Right, but if the uncompressed file is what's signed, then you must
> > waste either CPU uncompressing twice (once to verify, once to untar) or
> > waste disk (to store the uncompressed file, then verify, then untar).
> bzip2 -d < foo.tar.bz2 | tee >(md5sum) | tar xf
> or
> bzip2 -d < foo.tar.bz2 | tee >(gpg --verify foo.tar.bz2.sig) | tar xf

Yup, but (besides the tar tpyo you corrected later) this still isn't

1) gpg --verify won't be able to complete until it's seen all the unpacked
tar file.

2) During that time tar -xf - will be unpacking and writing.

3) If the signature is bad, too late you've already unpacked it:
-At best you need to blow away what you just unpacked.
-Worse, it may have just (over)written real files in pwd other than
the ones you think it should have.
-Worst, if the tarfile is maliciously crafted to exploit tar (..'ing
archive, symlink-following archive, or bad data which overflows
tar), who-knows-what damage is already done. This might sound
far-fetched, except that it already happens.

...But it sounds like the whole discussion is dead anyway. It would be
at least slightly less off-topic on security-audit, perhaps we should
move it there ( Or to alt.tinfoil.hat.

Hank Leininger <>
E407 AEF4 761E D39C D401 D4F4 22F8 EF11 861A A6F1


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:34    [W:0.067 / U:7.804 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site