vhaudiquet/pkh
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

build: render the source .buildinfo from its own checksum set

Browse Source 
The source pipeline used one checksum map for two documents with
different content: the .buildinfo (which, like dpkg-genbuildinfo, lists
only the referenced .dsc) and the .changes (which distributes the dsc,
the tarballs and the buildinfo itself). Because the tarballs and the
buildinfo were inserted into the shared map before the signing cascade
re-rendered the .buildinfo, every signed source build produced a
.buildinfo listing the tarballs — which dpkg-genbuildinfo never emits —
and itself, with the stale digest of its own pre-signature content.

Split the map: the .buildinfo renders from the referenced .dsc only
(refreshed after the .dsc is signed), the .changes keeps the full
distribution set with the signed buildinfo's fresh digests. Verified
with a throwaway GPG key: the signed .buildinfo lists exactly one entry,
the .dsc, matching the signed file.
This commit is contained in:
vhaudiquet
2026-09-18 00:25:17 +02:00
parent af870cb7cb
commit 1fc1d1aa77
1 changed files with 17 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/build/mod.rs
+17 -7
View File
@@ -458,8 +458,10 @@ pub fn run_source_build(
if let Some(u) = &ui {
u.progress_message("Generating .buildinfo");
}
let mut checksums = FileChecksums::new();
checksums.add_file_as(&ref_dsc_path, &ref_dsc_name)?;
// What the .buildinfo itself records: like dpkg-genbuildinfo, only the
// referenced .dsc — not the tarballs, and never the buildinfo itself.
let mut buildinfo_checksums = FileChecksums::new();
buildinfo_checksums.add_file_as(&ref_dsc_path, &ref_dsc_name)?;
let status_path = PathBuf::from("/var/lib/dpkg/status");
let bd_fields = [ctrl.source.get("Build-Depends").unwrap_or("")];
@@ -484,7 +486,7 @@ pub fn run_source_build(
environment: environment.clone(),
})
};
buildinfo::save_buildinfo(&buildinfo_path, &render_buildinfo_doc(&checksums))?;
buildinfo::save_buildinfo(&buildinfo_path, &render_buildinfo_doc(&buildinfo_checksums))?;
// Register the .buildinfo in debian/files (as dpkg-genbuildinfo does).
let files_path = cwd.join("debian/files");
@@ -506,6 +508,10 @@ pub fn run_source_build(
if let Some(u) = &ui {
u.progress_message("Generating .changes");
}
// What the .changes distributes: the .dsc (with its recorded digests),
// the tarballs listed in it (below), and the .buildinfo (last, as
// dpkg-genchanges does when it consumes debian/files).
let mut checksums = buildinfo_checksums.clone();
// Pull the tarball checksums out of the referenced .dsc so they are
// distributed through the .changes like dpkg-genchanges does, in the
// order the .dsc itself lists them.
@@ -682,18 +688,22 @@ pub fn run_source_build(
log::info!("Signing {}", dsc_name);
crate::utils::gpg::clearsign_file(&dsc_path, &keyid)?;
// The freshly built .dsc changed: refresh its checksums inside the
// .buildinfo. For binary-only builds the metadata references the
// The freshly built .dsc changed: refresh its digests in both
// checksum sets. For binary-only builds the metadata references the
// *previous* .dsc (untouched by this build), so there is nothing to
// refresh.
if !entry.binary_only {
buildinfo_checksums.add_file_as(&dsc_path, &dsc_name)?;
checksums.add_file_as(&dsc_path, &dsc_name)?;
}
buildinfo::save_buildinfo(&buildinfo_path, &render_buildinfo_doc(&checksums))?;
// Re-render the .buildinfo from its own set (the .dsc only, like
// dpkg-genbuildinfo): it must not list the tarballs or itself.
buildinfo::save_buildinfo(&buildinfo_path, &render_buildinfo_doc(&buildinfo_checksums))?;
log::info!("Signing {}", buildinfo_name);
crate::utils::gpg::clearsign_file(&buildinfo_path, &keyid)?;
// Both .dsc and .buildinfo changed: refresh the .changes.
// Both .dsc and .buildinfo changed: refresh the .changes with the
// signed buildinfo's fresh digests.
checksums.add_file_as(&buildinfo_path, &buildinfo_name)?;
changes::save_changes(&changes_path, &render_changes_doc(&checksums))?;