[PATCH] gnu: Patch duplicity with --ignore-mdc-error.

  • Done
  • quality assurance status badge
Details
2 participants
  • Leo Famulari
  • Christopher Baines
Owner
unassigned
Submitted by
Christopher Baines
Severity
normal

Debbugs page

Christopher Baines wrote 7 years ago
(address . guix-patches@gnu.org)
20180729154152.11296-1-mail@cbaines.net
Modify the package to patch gnu.py with an unreleased upstream change to fix
duplicity working with recent releases of GnuPG. This change make the package
build again.

* gnu/packages/backup.scm (duplicity)[arguments]: Patch gnu.py within the
patch-source phase.
---
gnu/packages/backup.scm | 9 +++++++++
1 file changed, 9 insertions(+)

Toggle diff (22 lines)
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index 9884f58fc..0733d9c34 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -105,6 +105,15 @@
(substitute* "duplicity/gpginterface.py"
(("self.call = 'gpg'")
(string-append "self.call = '" (assoc-ref inputs "gnupg") "/bin/gpg'")))
+
+ ;; This matches up with an unreleased upstream fix, it should be
+ ;; removed when the package is updated
+ ;; https://bazaar.launchpad.net/~duplicity-team/duplicity/0.8-series/revision/1308
+ (substitute* "duplicity/gpg.py"
+ (("--no-secmem-warning'\\)")
+ "--no-secmem-warning')
+ gnupg.options.extra_args.append('--ignore-mdc-error')"))
+
(substitute* '("testing/functional/__init__.py"
"testing/overrides/bin/lftp")
(("/bin/sh") (which "sh")))
--
2.18.0
Christopher Baines wrote 7 years ago
(address . 32303-done@debbugs.gnu.org)
87va8qfu5k.fsf@cbaines.net
Christopher Baines <mail@cbaines.net> writes:

Toggle quote (10 lines)
> Modify the package to patch gnu.py with an unreleased upstream change to fix
> duplicity working with recent releases of GnuPG. This change make the package
> build again.
>
> * gnu/packages/backup.scm (duplicity)[arguments]: Patch gnu.py within the
> patch-source phase.
> ---
> gnu/packages/backup.scm | 9 +++++++++
> 1 file changed, 9 insertions(+)

Pushed now :)
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEPonu50WOcg2XVOCyXiijOwuE9XcFAltlWpdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDNF
ODlFRUU3NDU4RTcyMEQ5NzU0RTBCMjVFMjhBMzNCMEI4NEY1NzcACgkQXiijOwuE
9XeFOg//Ql5VP+ZXvJo4JL5jSikLamCRoo4GcypmcK+gXKj+5fG1nLH573z+Dh8t
QFev5y+fKlpwwVvtaDnkphMMniwANvS+e+HLdPm4tr9dSrlJIkbluF1ZIiBUgo6k
cZbZqoJ7hEv1wPrL81Lm6A/dVYiglR+Mi30sfx4CkqxatGa84wyRoEw49oCYu8fH
9ZscTJ3lD0fTwZ8GxQOx683Qk/WH6gEdmuwzWoqtWEc1ulQdZgqpUn/GE37xM5cL
4nmHscVhly5KGMDkHwx5e+eNdmoL8SuKLLCYtrJsjd1gAZy0b4goQpLvI/Sk/TYM
s8K67iaXmsZBIDFpKfWSMROslmr88Lke0wTsq4ixvfwr609C3jR/3UVAG+HdYveY
Dm8ArqJDRdn9Fsk1ieRXeHZyXEo0hnbIh+Lsb/Lul5cDWvtY+LyUaN7NJeiNeJ9y
oMhbGb1iRtmNFE6ch4y1RbYZMZaXNp5i+a5rC7gtjNF3Brz3I5fGyU3XIRDG7k4q
aCaCLhCJmv74dR4zjxbYJ+0U3NdxW3qlupbgbZHII0b7HdqFL6wpwCmnYyheT1NL
obAZxGQLvGdp/ZVvYpb+K5Yom095np2Hvli1FHzSVPKOIi955qchL8Sb7iEkkNBG
D+y3QUSc5MejAjDLVXAe7R1qwEDfRciKPwQw0u22H+EyyH+028I=
=JfkS
-----END PGP SIGNATURE-----

Closed
Leo Famulari wrote 7 years ago
(name . Christopher Baines)(address . mail@cbaines.net)(address . 32303@debbugs.gnu.org)
20180807165649.GA917@jasmine.lan
On Sun, Jul 29, 2018 at 04:41:52PM +0100, Christopher Baines wrote:
Toggle quote (6 lines)
> Modify the package to patch gnu.py with an unreleased upstream change to fix
> duplicity working with recent releases of GnuPG. This change make the package
> build again.
>
> + gnupg.options.extra_args.append('--ignore-mdc-error')"))

Thanks for taking care of this package.

I'm concerned about the impact of this change, and Duplicity in general.

By ignoring the result of the MDC (modification detection code) check, I
*think* Duplicity loses the ability to authenticate its archives. If so,
the Duplicity package description should be changed to reflect this. I
would at least remove the text about safety against modification.

Also and FYI, Duplicity uses the MD4 message digest truncated to 64 bits
(via librsync) to identify chunks for deduplication. [0] MD4 collisions
are trivial to generate.

It's not totally reasonable to remove packages like backup programs
since, in the future, people will want to read the archives they have
created. But perhaps we should steer users away from Duplicity in the
package description.

[0] See:
... also briefly discussed in our bug tracker:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAltpz04ACgkQJkb6MLrK
fwijERAAufXPJJ5QZyYc9/ZKrux9pqAJOIbSc9UhT/59Hkragw637LpmzAP4lUMX
+LvinlJLSHCqVZfo8MIP2VA6uDwtdZSPIHVYUf7WIKx5DsA/KWrFFnD8CT9otxP3
PWPtxN750BIx6lsJSt27115vcDDDFzIV/9RNrF3D2FNBdFxTfPqPAfIo/6J7uA7Y
IIBb2CNzVJFsY8sYmMD85h5aTYnt7IGmMqS7Ysm2TDqheM0ykMrbJxDYpQKJMWvp
IQ/m5aPDGm6ttA3VtzUFPf1Su5f/zKH7e5Av3FGDS8RepcP54KTr4bm70ogN6+cD
MHGWlgjYuJFGKfb/gFKfqgnvQ42B5s/Whz0SaVJiqnxIdQBWEFUGB2+Xd/Nf13Pa
d1P0oZytMyvvTvcbef1N6Ut7DhRY6hVDEW7+9W/qmeotpbn8ifu1RCNz2QwelIc4
ebK8ZNuCYc+n9+x57E82qhvsTW5KrzrQ7OdyFXt+wg2q8p9ScIf9iqD/5cfMWv5B
rdTFgXr7krbWTiGkQOuLzbIadU31GojR6zxigs5kaYJCTRJA9fkwOUlxS9Ptnf2E
B3MrVV1HPzkiD+j8yfEUzhPwmBQVQbCh5w5wFVVNfzrMWS4fedSgBphFroF6tEo9
15A+J1NxKQ3h/in9faebeUFQfqQ3k79voPoQuHOkT0QE1gJVeFk=
=yMwP
-----END PGP SIGNATURE-----


Christopher Baines wrote 7 years ago
(name . Leo Famulari)(address . leo@famulari.name)(address . 32303@debbugs.gnu.org)
87ftzakul8.fsf@cbaines.net
Leo Famulari <leo@famulari.name> writes:

Toggle quote (20 lines)
> On Sun, Jul 29, 2018 at 04:41:52PM +0100, Christopher Baines wrote:
>> Modify the package to patch gnu.py with an unreleased upstream change to fix
>> duplicity working with recent releases of GnuPG. This change make the package
>> build again.
>>
>> + gnupg.options.extra_args.append('--ignore-mdc-error')"))
>
> Thanks for taking care of this package.
>
> I'm concerned about the impact of this change, and Duplicity in general.
>
> By ignoring the result of the MDC (modification detection code) check, I
> *think* Duplicity loses the ability to authenticate its archives. If so,
> the Duplicity package description should be changed to reflect this. I
> would at least remove the text about safety against modification.
>
> Also and FYI, Duplicity uses the MD4 message digest truncated to 64 bits
> (via librsync) to identify chunks for deduplication. [0] MD4 collisions
> are trivial to generate.

Hmm, this does look like more of an issue that I anticipated. I was
thinking that this was maybe to do with the tests alone, but checking
the upstream change again, it looks like it effects general operation.

Toggle quote (5 lines)
> It's not totally reasonable to remove packages like backup programs
> since, in the future, people will want to read the archives they have
> created. But perhaps we should steer users away from Duplicity in the
> package description.

Yeah, removing the statement about "modification" in the description
sounds like a good step. I don't know enough to add something more
informative to the description though.

One extra thing to note is that I use duplicity (well, not much) through
Deja Dup, so if there is issues with duplicity to describe in the
package description, it might be good to add something similar to the
few packages that use duplicity.

Thanks for looking in to this Leo :)
-----BEGIN PGP SIGNATURE-----

iQKSBAEBCgB9FiEEPonu50WOcg2XVOCyXiijOwuE9XcFAlt5ySNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDNF
ODlFRUU3NDU4RTcyMEQ5NzU0RTBCMjVFMjhBMzNCMEI4NEY1NzcACgkQXiijOwuE
9XfiVA/4qPfrEMPEr8FP8KugBQfXU5viDgNzt1GB8/cXFD37zuwhABR7bjmUf6aQ
tBftMJnPxuLgm0+4d3JC6bAm5wVrleFvYMUR7RCSc3Wjn7Y07MC6OsnXeDs1REKw
cygsnt59zm8oGkDI+7BMbfSNNqzqTzOAGTbdXmfGcGp1VUrPKz0ls2Pw7xlLhgdW
WQTYWCm2BtbOFhoQ8CQTJXU4XmwOysQU6xK2kZsX+ECZ6UFlE7JW8Lh3WilTsFAd
3qxYYDvD0ilOO3pctAV7qCV0ghgrfDb6nVUKsh3vifwcF01VcQhGZ87yueDD5v2s
z/zZ6TAk7SigdZkoGTCuMAiCp9Lh89KMMQaPUHe2+6YjkkRfSR93X6TIrkY0yROP
O9w9yeliV0fhtbyvEBI63TMc6i0+vG2ZC32ed90WkuVfZq4Bg+uXEWE1wYe9q3b5
J1R5OPhsn/m0TBs1y2YWISEM8DriXXMaW6L21sE+rPhiJvWGPw7ZQk7E3RTZZVx7
6BF2RzE96LRkHmOTQk8IbrAEstdVmvWnhTNCUrHxgagmnljomiibu6NXw23c9qhr
PCgdRgudcXoCWaPv8B29842h6zhntE1jkFRgcjmzyXdRzGTohYtNcyt7wi45bh3G
r4MRqzZvzl4al3aVYtOv4xQ14HSMqEjoDYAGRQ8K2CungiFR6A==
=38/o
-----END PGP SIGNATURE-----

Leo Famulari wrote 7 years ago
(name . Christopher Baines)(address . mail@cbaines.net)(address . 32303@debbugs.gnu.org)
20180822210523.GA5079@jasmine.lan
On Sun, Aug 19, 2018 at 08:46:43PM +0100, Christopher Baines wrote:
Toggle quote (2 lines)
> Thanks for looking in to this Leo :)

A few days ago, I sent an email to <duplicity-talk@nongnu.org>
requesting clarification on how this affects Duplicity. I think my
message is still waiting for moderation but hopefully it goes through.
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlt90BAACgkQJkb6MLrK
fwi03A//dL8NoAKcVQnXkzpmUjJDzJEgMhwjMNW8G4lhLwX11vX6tCrAepdlnbYb
rVdDtfoThTnXtu9AsG1NxLumwdQMrfeSXxWQQJSHRpLMjWgOodwTKQbwINEt7Dka
0tz6PM/nGXmCC25pRKXgx8qTnuyh4Fq9+Pdwiks8nc7prPwHYABkyCPOe4Gl4K5n
Q9TD/BrohOS9Bp1mMMZ/IvPfrPZLd/uMytp38NwIK1riHCXDgBVB0tdna1TloS3S
4dtzw1Ao7+5liUQWTZgRpqqsfhcBnqFx0b+E2VZUjO5h2Dua9zl2YbCJEypZbxmK
eFV7pwzJOYTUe/erut02A6rt1YkD1/940UhAwA+3Q9lKE3qyi8FLD3P1fUq+S3Qo
FXUULHitwEHc1VWamKnJ932HKvk7I4ys9rHU4ardIm9O/gddl9DhHELxWqdBrZEE
w5+H3Mqi7l5ZpjWyJKLFsrUi/uHG4u3G/tYm8JnUuPuxxcZooInd5lDrFxLnmbwH
clvp1dOWolwcfCYo/n2hiakd/8luYzFT7tdO0NMKmBao7lPoJ/1sCvuV08+PLo2/
DFrUmsy86oUmh+tvNuO6/I8+VauQQRzgPsvCgiryq78UxNHqey/aJCXDTDDoJRI7
HD4+dLa869b630Q2pwToywHKRhS2U4ohFgIxUaJcSLu3uLnskNw=
=gXE9
-----END PGP SIGNATURE-----


Leo Famulari wrote 7 years ago
(name . Christopher Baines)(address . mail@cbaines.net)(address . 32303@debbugs.gnu.org)
20180906172620.GA2362@jasmine.lan
On Wed, Aug 22, 2018 at 05:05:23PM -0400, Leo Famulari wrote:
Toggle quote (4 lines)
> A few days ago, I sent an email to <duplicity-talk@nongnu.org>
> requesting clarification on how this affects Duplicity. I think my
> message is still waiting for moderation but hopefully it goes through.

The Duplicity project clarified the effect of this change on the
integrity of the backup archives:

"Duplicity does a hash of the entire file so the MDC is duplication of
effort. [...] You are still protected by the hash stored in the
manifest." [0]

Based on that, I think the disabling of GnuPG's integrity check is not
that important in this case.

[0]
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAluRYzwACgkQJkb6MLrK
fwg9ZQ/+K0rz+npaKZlVLJnzywlBWVAxSWkJ6wI9WG+XJCj0A1h+rVMzCT0AbWSw
2tLzXYIUogbGf/Gffpb/N7WbewVfOS4/LETb1u01zSoVbWXFSUUsFPpdAAqs/qfI
Far5VEmRfVq79Yht+cIGQGEnAQBYZu2gtkGyWIK4KfWd7WiM1YJh/Vvajhorph8m
Jwfic3QY3GNpmL3OxFDjJHStawBFRXSStTk3/iLSQTB6Rsox6ewY6vI48rXr3Lfg
/v2h83K7oa8015u7jpLuef+K7Co6Xx2kcrW7skK2eOPaRLcdxl1FO7v1Vkw4LJyz
wcYkJZLZZc+/Ej7fxlr3f4/qHVN4POQ+R/w63lXhhi6Bh3CkYDSV8ZzlbNXbut61
AWZbzLvaZsYW12/f4kEoiJFW4725pB+lfy8adzMut10ySwTKBty9UnFRCPypl45A
QJQAhtyKejae94WhsyOu95RLnACH9Sej5FTamGNx510xCccaz48Ca11tPTNEs3J5
oyqnhC4QBq2PoHhOd4gPwNDdxUggzi4nuZPhNIAnuURVghRKMIzIS7nes1L77azB
JBP64a0kgzMpAM/QW4Sfw1hV0dHotTZz0tQ6TR2QHZhf4DPFQTwRlN7EPOfpxAgb
cly+W0FW/UG6A/oCulNexezqA09+C1mNWVoZcRD9U8yyQxHdBfY=
=aoGF
-----END PGP SIGNATURE-----


?
Your comment

This issue is archived.

To comment on this conversation send an email to 32303@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 32303
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch
You may also tag this issue. See list of standard tags. For example, to set the confirmed and easy tags
mumi command -t +confirmed -t +easy
Or, remove the moreinfo tag and set the help tag
mumi command -t -moreinfo -t +help