openSUSE / openSUSE/libsolv

Malformed repodata don't produce meaningful error messages

Open
#413 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
609
Forks
177
PR merge metrics
No merged PRs in 30d

Description

Original report: https://bugzilla.redhat.com/show_bug.cgi?id=1862204

Malformed repository: https://drive.google.com/file/d/1YHWJhhFFQPYfJ_bSEauF2Adzo040uKeL/view?usp=sharing

The repository, when loaded with dnf, doesn't raise an error when loaded the first time, but fails to load the second time. Arguably dnf just eats the error messages from libsolv and its messages are bad as well, but according to the debugging the reporter has done (I haven't tried to get to the exact libsolv error myself), libsolv doesn't properly report the malformed xml errors either.

The issue with the repodata is it's missing the outer xml tags, e.g. other.xml - malformed repo:

<package nevra="kernel-core-0:5.3.7-301.fc31.x86_64" type="rpm">
  <version epoch="0" ver="5.3.7" rel="301.fc31"/>
</package>

Valid other.xml for the repo:

<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1">
<package pkgid="f0509e333636e5c34726c8a2b8260bf88fe0a35b95cae6dda62191fee1be4c6a" name="kernel-core" arch="x86_64">
  <version epoch="0" ver="5.3.7" rel="301.fc31"/>
  <changelog author="Justin M. Forbes &lt;jforbes@fedoraproject.org&gt;" date="1570104000">- Fix CVE-2019-17052 CVE-2019-17053 CVE-2019-17054 CVE-2019-17055 CVE-2019-17056
  (rhbz 1758239 1758240 1758242 1758243 1758245 1758246 1758248 1758249 1758256 1758257)</changelog>
  <!-- ... changelog entries ommited for brevity -->
</package>
</otherdata>

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the malformed other.xml case from the issue and compare the first and second dnf loads. Trace how libsolv reports the malformed XML and how dnf handles those messages. Done means malformed repository metadata consistently fails with a meaningful error instead of being silently accepted or producing a poor message.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.