paccheck - pacman package authenticity check

toad · 2011-03-18 09:31:42

IG banned? What has he done now????

Oh, package signing again... Shame that differences in opinion lead to people getting banned - seems very childish.

But on topic again:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
THE FOLLOWING PACKAGES IN PACMAN'S PKG CACHE ARE THE WRONG SIZE - this
indicates they are corrupt, or they or the database has been tampered
with:

    archlinuxfr/lsb-release-1.4-10  (cache 6204 != db 6200)
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

All OK.

System update is NOT recommended until the above issues are addressed.

Anybody else getting this?

pablokal · 2011-03-18 11:24:00

If you got this after using paccheck this must an effective warning!
I would take the recommendation serious.
You could post your question again on the Arch section of LinuxQuestions as IG will be probably find your question there: http://www.linuxquestions.org/questions/arch-29/
On his blog IG writes he is blocked and not able to visit this site any more.

toad · 2011-03-18 11:43:18

Thanks pablokal Yes, I got it after running paccheck.

IG wrote a reply on the package signing thread and tread on some peoples' toes, ergo banned. I doubt he is interested in Arch any more as a result. Big shame.

I just wondered whether anybody else got this message...

falconindy · 2011-03-18 12:27:08

You're comparing a package from a third party repo against the official mirrors. A difference in the compiler used could lead to a difference in package size. This is a false positive.

toad · 2011-03-18 12:34:05

Thanks, falconindy.

Odd, I've done the same on my laptop (also 64 bit) and didn't get the warning and try as I may, I cannot get my head round the reason for this difference. Granted, the mirrors are different, but I still don't get it.

falconindy · 2011-03-18 12:37:07

archlinuxfr is a third party repo which builds their own packages. Official mirrors just sync from a tier above them. They choose to recompile packages from core/extra/community rather than sync for reasons I'm unaware of.

Last edited by falconindy (2011-03-18 12:39:06)

Gumper · 2011-03-26 02:35:03

Does anyone know if paccheck will continue to function properly with pacman 3.5?

Allan · 2011-03-26 02:53:58

Looks like it uses "repo.db.tar.gz" and not "repo.db" so it probably will not work with pacman-3.5.

Korrode · 2011-03-26 03:48:55

It's really too bad IG got banned he's also the guy who makes the pcmanfm-mod I use...

Gumper · 2011-03-26 03:50:47

Allan wrote:

Looks like it uses "repo.db.tar.gz" and not "repo.db" so it probably will not work with pacman-3.5.

Thanks Allan.

mundane · 2011-03-26 07:16:50

Gumper wrote:

Allan wrote:
Looks like it uses "repo.db.tar.gz" and not "repo.db" so it probably will not work with pacman-3.5.
Thanks Allan.

Bad design from IG.

repo.db has been a symlink to repo.db.tar.gz for a long time. repo.db is meant to be used in case the compression format gets changed, such as for pacman 3.5

berbae · 2011-03-26 22:16:04

I wrote an update to paccheck for it to work with pacman 3.5.1
I contacted IgnorantGuru to submit it to him and to ask if he intends to continue with that script and the paccheck package in AUR.

Last edited by berbae (2011-03-27 09:55:42)

berbae · 2011-03-27 15:00:17

An updated version is now available compatible with pacman >3.5 :
http://aur.archlinux.org/packages.php?ID=46763

It's recommended to use 3 or 4 different mirrors from diverse locations, and at least one for the full compare option.

The script can help to detect compromised mirrors for some hacking scenarios, but it doesn't guaranty a total security for more complex, though improbable, ones.

berbae · 2011-03-27 15:55:21

I updated the package to 0.8.13-2 because I forgot to include the mirrorlist example file.
Sorry.

berbae · 2011-03-27 20:35:13

The source origin is now corrected in 0.8.13-3 release.
I am sorry for the annoyance it caused before that.

I want to add that I appreciate the Arch Linux distribution, it is my preferred one.
I thanks all the devs for their good work and particularly Allan for the much welcome improvements in the pacman 3.5.1 release and
the advancement of package signing, which is not an easy task and also not a so pleasant one, I concede.

So thank you very much to all of you, guys!

I like working with Arch Linux.

milomouse · 2011-03-30 10:11:23

As a site note; in the `paccheck' source it checks for user's DBPath and if it's not set it will assign to /var/lib/pacman/sync but of course pacman default is /var/lib/pacman, so if you're going to check for user's DBPath you may want to append /sync to $dbpath if it's discovered to be set, otherwise it will attempt to check repo lists without /sync appended and fail.

berbae · 2011-03-30 15:12:22

milomouse wrote:

but of course pacman default is /var/lib/pacman

That was the default before pacman 3.5, now the sync database tar files are put directly in /var/lib/pacman/sync and without the .tar.gz extension :

[berbae@arch64 ~]$ ll /var/lib/pacman
total 40
drwxr-xr-x 669 root root 36864 29 mars  23:45 local
drwxr-xr-x   2 root root  4096 30 mars  15:45 sync
[berbae@arch64 ~]$ ll /var/lib/pacman/sync
total 948
-rw-r--r-- 1 root root 442384 29 mars  21:04 community.db
-rw-r--r-- 1 root root  38276 29 mars  18:41 core.db
-rw-r--r-- 1 root root 472426 29 mars  15:39 extra.db

So there are no DB files in /var/lib/pacman anymore.
That's why I changed the default value of the dbpath variable in the script to '/var/lib/pacman/sync'.

So when using the DBPath variable in /etc/pacman.conf, the user has to write the complete path to where the database files are.
That's logical that the DBPath variable should contain exactly the place where the DB tar files are (not a parent directory).

But thanks for your post.

Edit : the infos here are wrong, see following posts. Sorry for that.

Last edited by berbae (2011-03-30 22:49:54)

milomouse · 2011-03-30 16:18:30

That's weird. I guess pacman appends /sync to my DBPath then? Because mine is /var/cache/packages/database not /var/cache/packages/database/sync so I guess pacman is doing it for me because the *db's are in $DBPath/sync. I'll mess around with this-- sorry for the static.

Edit: What made me think this is because original 3.5 pacman.conf shows commented DBPath = /var/lib/pacman/

Last edited by milomouse (2011-03-30 16:25:58)

Allan · 2011-03-30 22:12:44

berbae wrote:

So when using the DBPath variable in /etc/pacman.conf, the user has to write the complete path to where the database files are.
That's logical that the DBPath variable should contain exactly the place where the DB tar files are (not a parent directory).

No... DBPath=/var/lib/pacman is correct. If reading the DBPath from pacman.conf, you will need to add sync to the end of it.

berbae · 2011-03-30 22:28:39

milomouse wrote:

so I guess pacman is doing it for me because the *db's are in $DBPath/sync.

I verified and I saw that you are right, so I was wrong to change the default dbpath variable in the script.

I corrected that in the paccheck 0.8.14 version.

Thank you for your contribution.

Edit: Thank you Allan, I saw your post after I made the correction, but you confirm what milomouse signaled to me.

Last edited by berbae (2011-03-30 22:45:44)

milomouse · 2011-03-31 12:17:33

No worries, and thanks for maintaining the script. :}

Arch Linux

#51 2011-03-18 09:31:42

Re: paccheck - pacman package authenticity check

#52 2011-03-18 11:24:00

Re: paccheck - pacman package authenticity check

#53 2011-03-18 11:43:18

Re: paccheck - pacman package authenticity check

#54 2011-03-18 12:27:08

Re: paccheck - pacman package authenticity check

#55 2011-03-18 12:34:05

Re: paccheck - pacman package authenticity check

#56 2011-03-18 12:37:07

Re: paccheck - pacman package authenticity check

#57 2011-03-26 02:35:03

Re: paccheck - pacman package authenticity check

#58 2011-03-26 02:53:58

Re: paccheck - pacman package authenticity check

#59 2011-03-26 03:48:55

Re: paccheck - pacman package authenticity check

#60 2011-03-26 03:50:47

Re: paccheck - pacman package authenticity check

#61 2011-03-26 07:16:50

Re: paccheck - pacman package authenticity check

#62 2011-03-26 22:16:04

Re: paccheck - pacman package authenticity check

#63 2011-03-27 15:00:17

Re: paccheck - pacman package authenticity check

#64 2011-03-27 15:55:21

Re: paccheck - pacman package authenticity check

#65 2011-03-27 20:35:13

Re: paccheck - pacman package authenticity check

#66 2011-03-30 10:11:23

Re: paccheck - pacman package authenticity check

#67 2011-03-30 15:12:22

Re: paccheck - pacman package authenticity check

#68 2011-03-30 16:18:30

Re: paccheck - pacman package authenticity check

#69 2011-03-30 22:12:44

Re: paccheck - pacman package authenticity check

#70 2011-03-30 22:28:39

Re: paccheck - pacman package authenticity check

#71 2011-03-31 12:17:33

Re: paccheck - pacman package authenticity check

Board footer