Bug 291343 - Ports can use fetched files that are not fingerprinted
Summary: Ports can use fetched files that are not fingerprinted
Status: Closed Works As Intended
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Ports Framework (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Port Management Team
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-12-02 06:13 UTC by Yuri Victorovich
Modified: 2025-12-02 17:48 UTC (History)
1 user (show)

See Also:


Attachments
testcase-fetched-file-no-fingerprint.tgz (774 bytes, application/gzip)
2025-12-02 06:13 UTC, Yuri Victorovich
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Yuri Victorovich freebsd_committer freebsd_triage 2025-12-02 06:13:59 UTC
Created attachment 265766 [details]
testcase-fetched-file-no-fingerprint.tgz

The attached sample port downloads and installs a file that isn't in DISTFILES and doesn't have a record in distinfo.

In this example it downloads https://google.com/index.html and installs it as ${DATADIR}/possibly-malicious.html, but it can be any file.

The files fetched in the fetch target but not listed in DISTFILES can be installed like this.

I am not saying that there are malicious ports, but the ports framework enforces cryptographic fingerprints on all used distfiles, and this example uses a loophole and some files might not be fingerprinted.

The following solution can solve the above problem: Poudriere should use a dedicated DISTDIR for each package build process.
(1) Before the fetch: Poudriere would copy all declared DISTFILES (if they exist) from the common build directory into this dedicated directory.
(2) After the fetch: Poudriere would check that there are no files in the dedicated directory that aren't declared in the DISTFILES file.
(3) After the build: Poudriere would copy them back from the dedicated directory into a common directory.
Comment 1 Yuri Victorovich freebsd_committer freebsd_triage 2025-12-02 07:14:51 UTC
Why does this work as intended?

Why do we need distinfo at all if these files can be downloaded and used without fingerprints?
Comment 2 Mathieu Arnold freebsd_committer freebsd_triage 2025-12-02 17:48:45 UTC
Because the framework lets anyone do stupid things.

The reason we have committers, like you, or me, and not a simple "merge" button, is to make sure patches that are submitted by non committers don't do stupid things, or that if they do, they get fixed before being committed.