Malformed repodata don't produce meaningful error messages
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 609
- Forks
- 177
- PR merge metrics
- No merged PRs in 30d
Description
Original report: https://bugzilla.redhat.com/show_bug.cgi?id=1862204
Malformed repository: https://drive.google.com/file/d/1YHWJhhFFQPYfJ_bSEauF2Adzo040uKeL/view?usp=sharing
The repository, when loaded with dnf, doesn't raise an error when loaded the first time, but fails to load the second time. Arguably dnf just eats the error messages from libsolv and its messages are bad as well, but according to the debugging the reporter has done (I haven't tried to get to the exact libsolv error myself), libsolv doesn't properly report the malformed xml errors either.
The issue with the repodata is it's missing the outer xml tags, e.g. other.xml - malformed repo:
<package nevra="kernel-core-0:5.3.7-301.fc31.x86_64" type="rpm">
<version epoch="0" ver="5.3.7" rel="301.fc31"/>
</package>
Valid other.xml for the repo:
<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1">
<package pkgid="f0509e333636e5c34726c8a2b8260bf88fe0a35b95cae6dda62191fee1be4c6a" name="kernel-core" arch="x86_64">
<version epoch="0" ver="5.3.7" rel="301.fc31"/>
<changelog author="Justin M. Forbes <jforbes@fedoraproject.org>" date="1570104000">- Fix CVE-2019-17052 CVE-2019-17053 CVE-2019-17054 CVE-2019-17055 CVE-2019-17056
(rhbz 1758239 1758240 1758242 1758243 1758245 1758246 1758248 1758249 1758256 1758257)</changelog>
<!-- ... changelog entries ommited for brevity -->
</package>
</otherdata>
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the malformed other.xml case from the issue and compare the first and second dnf loads. Trace how libsolv reports the malformed XML and how dnf handles those messages. Done means malformed repository metadata consistently fails with a meaningful error instead of being silently accepted or producing a poor message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100