Prefer dget to wget for some debian src downloads #14661
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
guillaumelambert
force-pushed
the
wget_to_dget
branch
4 times, most recently
from
3de6508 to
c80fe93
Compare
- use dget instead of wget in some Makefiles - switch related HTTP URL to HTTPS and official debian mirror when possible TODO: migrate azure debian mirror to debian official ones (this might require upgrading some debian packages version in rules/*.mk) NB: A more complete solution with apt-get is proposed in sonic-net#13381 SONiC images compilation is currently designed to be performed with a non-root user under Ubuntu systems. And the build process recompiles packages for various GNU+Linux Debian distributions. Though, there is no guarantee that debian repos are declared in /etc/apt/sources.list on the Ubuntu host system used. As a result, 'apt-get source' can not be directly used out-of-the-box. Currently, the packages sources are retrieved from more or less official URLs and locations with dget and wget. As discussed in the following URL https://serverfault.com/questions/447457/use-apt-get-source-on-a-debian-repo-without-using-etc-apt-source-list dget is the simplest solution. wget has several drawbacks from a maintenance and security standpoint: - retrieving multiple URLs - loose authentication of packages sources especially when retrieved with HTTP instead of HTTPS This is potentially vulnerable to MITM and can induce malicious code injection. dget by default verifies package signature and can prevent most of such MITM attacks Signed-off-by: Guillaume Lambert <guillaume.lambert@orange.com>
Signed-off-by: Guillaume Lambert <guillaume.lambert@orange.com>
guillaumelambert
force-pushed
the
wget_to_dget
branch
from
c80fe93 to
6162a99
Compare
guillaumelambert
requested review from
qiluo-msft,
xumia and
lguohan
as code owners
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
( to work, current azure mirror of debian pkg and src requires additional HTTP GET parameters incompatible with dget)
Why I did it
SONiC images compilation is currently designed to be performed with a non-root user under Ubuntu systems.
And the build process recompiles packages for various GNU+Linux Debian distributions.
Though, there is no guarantee that debian repos are declared in /etc/apt/sources.list on the Ubuntu host system used. As a result, 'apt-get source' can not be directly used out-of-the-box. Currently, the packages sources are retrieved from more or less official URLs and locations with dget and wget.
As discussed in the following URL
https://serverfault.com/questions/447457/use-apt-get-source-on-a-debian-repo-without-using-etc-apt-source-list dget is the simplest solution.
wget has several drawbacks from a maintenance and security standpoint:
dget by default verifies package signature and can prevent most of such MITM attacks
This verification is sometimes forgotten when multiple wget commands are needed (cf ntp package build)
Which release branch to backport (provide reason below if selected)
potentially all, but it might need slight modifications when cherry-picking
A picture of a cute animal (not mandatory but encouraged)
//
('>
/rr
*))_