[Bug debuginfod/28204] extend webapi / verification with forthcoming signed-contents archives

["mark at klomp dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28204

--- Comment #25 from Mark Wielaard <mark at klomp dot org> ---
So I am looking at users/rgoldber/try-bz28204d but it isn't clear you want to
merge that in separate commits or squashed together. I am comparing to
users/rgoldber/try-bz28204c which I believe is the previous version reviewed.

It really makes things a lot easier if the actual patches that are intended to
be merged are posted (with a description of what was changed since the last
review).

So as far as I can tell the new series has been rebased from commit
35e059b654224b1a01d05877b13582c74c692388 to
27a84961f7a061b83f10f7e02bf433c229d6537a. Good. That is just 3 commits.

- configure.ac checks updated.
- debuginfod/debuginfod-client.c introduces ima_policy_t
  Includes an "undefined" policy?
  debuginfod_validate_imasig updated to read/digest in chunks of DATA_SIZE.
  Is the k += DATA_SIZE correct? Can't pread return an n < DATA_SIZE?
  If the cert_paths = strdup (...) fails cert_paths gets assigned a static
string?
  Won't that crash the strtok calls or the free (cert_path) call?
  In debuginfod_query_server the server_urls are parsed to see te ima policy,
  as described debuginfod-client-config.7

Sorry, have to stop for a bit. Will try to look at the rest later.

-- 
You are receiving this mail because:
You are on the CC list for the bug.