Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 646074 - games-rpg/runescape-launcher Should verify PGP signature instead of hash
Summary: games-rpg/runescape-launcher Should verify PGP signature instead of hash
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: Normal normal (vote)
Deadline: 2019-10-28
Assignee: Jack Coulter
URL:
Whiteboard:
Keywords: PMASKED
Depends on:
Blocks:
 
Reported: 2018-01-29 20:17 UTC by David Pedersen
Modified: 2019-10-31 15:36 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Pedersen 2018-01-29 20:17:00 UTC 
The .deb provided for RuneScape changes a few times a month leading to constant build errors because the checksums in the Manifest doesn't match. Arch Linux has solved this by verifying the PGP signature instead of hashes.
Gentoo should do the same to avoid constant breakage and the same bug reports again and again, see bugs: 590208 and 625884.

Arch Linux's PKGBUILD:
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=runescape-launcher
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2018-01-30 08:44:21 UTC 
ebuild runescape-launcher-2.2.4-r1.ebuild fetch
Appending /home/jer/git/gentoo to PORTDIR_OVERLAY...
>>> Downloading 'http://content.runescape.com/downloads/ubuntu/pool/non-free/r/runescape-launcher/runescape-launcher_2.2.4_amd64.deb'
--2018-01-30 09:43:51--  http://content.runescape.com/downloads/ubuntu/pool/non-free/r/runescape-launcher/runescape-launcher_2.2.4_amd64.deb
Resolving content.runescape.com (content.runescape.com)... 91.235.140.194, 91.235.140.195
Connecting to content.runescape.com (content.runescape.com)|91.235.140.194|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3016040 (2.9M) [application/octet-stream]
Saving to: ‘/aches/gentoo/distfiles/runescape-launcher_2.2.4_amd64.deb’

/aches/gentoo/distfiles/runescape-launc 100%[==============================================================================>]   2.88M   955KB/s    in 3.1s

2018-01-30 09:43:54 (955 KB/s) - ‘/aches/gentoo/distfiles/runescape-launcher_2.2.4_amd64.deb’ saved [3016040/3016040]

!!! Fetched file: runescape-launcher_2.2.4_amd64.deb VERIFY FAILED!
!!! Reason: Filesize does not match recorded size
!!! Got:      3016040
!!! Expected: 3014372
Refetching... File renamed to '/aches/gentoo/distfiles/runescape-launcher_2.2.4_amd64.deb._checksum_failure_.DdEBZQ'

!!! Couldn't download 'runescape-launcher_2.2.4_amd64.deb'. Aborting.
Comment 2 David Pedersen 2018-01-31 23:54:27 UTC 
(In reply to Jeroen Roovers from comment #1)
> ebuild runescape-launcher-2.2.4-r1.ebuild fetch
> Appending /home/jer/git/gentoo to PORTDIR_OVERLAY...
> >>> Downloading 'http://content.runescape.com/downloads/ubuntu/pool/non-free/r/runescape-launcher/runescape-launcher_2.2.4_amd64.deb'
> --2018-01-30 09:43:51-- 
> http://content.runescape.com/downloads/ubuntu/pool/non-free/r/runescape-
> launcher/runescape-launcher_2.2.4_amd64.deb
> Resolving content.runescape.com (content.runescape.com)... 91.235.140.194,
> 91.235.140.195
> Connecting to content.runescape.com
> (content.runescape.com)|91.235.140.194|:80... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 3016040 (2.9M) [application/octet-stream]
> Saving to: ‘/aches/gentoo/distfiles/runescape-launcher_2.2.4_amd64.deb’
> 
> /aches/gentoo/distfiles/runescape-launc
> 100%[========================================================================
> ======>]   2.88M   955KB/s    in 3.1s
> 
> 2018-01-30 09:43:54 (955 KB/s) -
> ‘/aches/gentoo/distfiles/runescape-launcher_2.2.4_amd64.deb’ saved
> [3016040/3016040]
> 
> !!! Fetched file: runescape-launcher_2.2.4_amd64.deb VERIFY FAILED!
> !!! Reason: Filesize does not match recorded size
> !!! Got:      3016040
> !!! Expected: 3014372
> Refetching... File renamed to
> '/aches/gentoo/distfiles/runescape-launcher_2.2.4_amd64.deb.
> _checksum_failure_.DdEBZQ'
> 
> !!! Couldn't download 'runescape-launcher_2.2.4_amd64.deb'. Aborting.

Exactly. And this will happen again and again unless we move over to verifying PGP.
Comment 3 Pacho Ramos gentoo-dev 2018-02-28 20:32:33 UTC 

*** This bug has been marked as a duplicate of bug 625884 ***
Comment 4 David Pedersen 2018-02-28 21:21:53 UTC 
(In reply to Pacho Ramos from comment #3)
> 
> *** This bug has been marked as a duplicate of bug 625884 ***

This is not a duplicate. This issue is about using PGP signatures to avoid future issues.
Comment 5 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2019-10-31 15:36:52 UTC 
Package removed.