Re: [Security-Discuss] problem with 2005 cpio update

On 12-Jul-05, at 10:41 AM, Rolf Pedersen wrote:

> I updated my --update source and used urpmi, as I always do, to try  
> the update.  There was an unsatisfied /sbin/rmt, which exact file I  
> could not find in the distro.  The rpm on my mirror, ftp.ciril.fr,  
> did not pass the GPG check, even after I (re)installed the pubkey.   
> After

Did it fail the gpg check the second time?

> downloading the file, urpmi prompted to install the apparent  
> dependency and I chose tar, which got cpio upgraded but tar, it  
> turns out, was already installed.  The date on the cpio rpm on the  
> mirror is
>
> cpio-2.6-3.1.102mdk.i586.rpm      108 KB  07/06/2005  11:19:00 PM
>
> which seems strange, as that is 5 days before the date of the  
> advisory.

Not so strange.  That's the date the package was built (look at the  
changelog).

> # urpmi --clean --skip kernel-source --update --auto-select
> Some package requested cannot be installed:
> cpio-2.6-3.1.102mdk.i586 (due to unsatisfied /sbin/rmt)
> Continue? (Y/n)
> # urpmf /sbin/rmt
> tar:/sbin/rmt-tar
> rmt:/sbin/rmt-dump
> openafs-server:/usr/sbin/rmtsysd
> star:/usr/sbin/rmt-star
> # rpm -K
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm:
> (sha1) dsa sha1 MD5 GPG NOT OK
> # rpm --import
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/media_info/pubkey
> # rpm -K
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm:
> (sha1) dsa sha1 MD5 GPG NOT OK

Wierd.  Not sure why it's failing:

[qateam@mercury RPMS]$ rpm -K cpio-2.6-3.1.102mdk.i586.rpm
cpio-2.6-3.1.102mdk.i586.rpm: (sha1) dsa sha1 md5 gpg OK
[qateam@mercury RPMS]$ rpm -Kvv cpio-2.6-3.1.102mdk.i586.rpm
D: Expected size:       110029 = lead(96)+sigs(344)+pad(0)+data(109589)
D:   Actual size:       110029
D: opening  db environment /var/lib/rpm/Packages  
create:cdb:mpool:private
D: opening  db index       /var/lib/rpm/Packages rdonly mode=0x0
D: locked   db index       /var/lib/rpm/Packages
D: opening  db index       /var/lib/rpm/Pubkeys rdonly mode=0x0
D:  read h#     365 Header sanity check: OK
D: ========== DSA pubkey id 9aa8d0d022458a98
cpio-2.6-3.1.102mdk.i586.rpm:
     Header V3 DSA signature: OK, key ID 22458a98
     Header SHA1 digest: OK (6f221a7f005998075485c71813ace59f1ac12d06)
     MD5 digest: OK (81a7bd6333f4f74722203751951d1c6d)
     V3 DSA signature: OK, key ID 22458a98
D: closed   db index       /var/lib/rpm/Pubkeys
D: closed   db index       /var/lib/rpm/Packages
D: closed   db environment /var/lib/rpm/Packages
[qateam@mercury RPMS]$ ls -al cpio-2.6-3.1.102mdk.i586.rpm
-rw-r--r--  1 qateam qateam 110029 Jul  6 17:19  
cpio-2.6-3.1.102mdk.i586.rpm


> # wget
> ftp://ftp.ciril.fr/pub/linux/mandrakelinux/official/updates/LE2005/ 
> main_updates/./cpio-2.6-3.1.102mdk.i586.rpm
> # md5sum cpio-2.6-3.1.102mdk.i586.rpm
> 9db16a5fa7bfc85aa7bb2d199ab5d825 cpio-2.6-3.1.102mdk.i586.rpm
> # urpmi cpio-2.6-3.1.102mdk.i586.rpm
> One of the following packages is needed:
> 1- tar-1.15.1-2mdk.i586 : A GNU file archiving program (to upgrade)
> 2- rmt-0.4b37-2mdk.i586 : Provides certain programs with access to
> remote tapedevices (to upgrade)
> What is your choice? (1-2) 1

This is some stupidity in urpmi.  I suppose we could make cpio  
require tar directly (I don't imagine there are too many people  
without tar on their system) which would resolve that dumb  
requirement, but this is a bug in urpmi AFAICT because, you're right,  
tar is already installed.

> installing cpio-2.6-3.1.102mdk.i586.rpm
> Preparing... #############################################
> 1/1: cpio
> # rpm -q tar
> tar-1.15.1-2mdk
> # rpm -qa --last | head
> cpio-2.6-3.1.102mdk Tue 12 Jul 2005 08:56:53 AM PDT
> gpg-pubkey-22458a98-3969e7de Tue 12 Jul 2005 08:47:39 AM PDT
> gcombust-0.1.55-4mdk Fri 08 Jul 2005 06:41:51 PM PDT
> cdrecord-cdda2wav-2.01.01-0.a01.6.1.102mdk Fri 08 Jul 2005 06:41:50
> PM PDT
> [..]
>
> # rpm -q cpio
> cpio-2.6-3.1.102mdk

The thing that concerns me is the GPG key thing.  It shouldn't give  
you that error about a failed sig.  It doesn't here.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}