Comments (8)
Do the artifact have the same id/version/classifier? p2 may optimize the download as it assumes that artifact with same id/version/classifier are the same independently of the source repository; so it is expected to fetch them from whatever source it thinks is best.
from p2.
Yes, that's the idea. If the artifact with the same key is available in some local disk (file: URI) repository then reusing it will avoid waiting for a slow download...
from p2.
Not sure about the classifier but id/version are definitely the same yes.
On one hand I agree that technically artifacts with exactly the same id+version+classifier should be the same,
on the other, apart from the fact this is very surprising behavior, this becomes a big problem security wise no?
Say we have some repo of known good verified artifacts we list in our target and to be compliant with our security policy need all artifacts in the final product to come from there. Now if I have a build machine which used to get artifacts from some different repo and remembers this, by keeping to use that old repo and sidestepping the one it breaks this policy.
Even worse case would be attack which manages to sneak in some completely different repo which contains artifacts with same id but malicious content (p2 has to read the repo list from some persistent file on disk I suppose, so appending to it is not out of question). This would be pretty hard to detect because nothing changed in the source, just in local environment of the build machine.
Also a related question - is there some way to make p2 verbosely log where it is downloading each artifact from? When going through the code I saw it emits some provisioning events which contain the info I need, but I'd like to configure something to print these events without having to write and install my own listener
from p2.
be attack which manages to sneak in some completely different repo
Then the attack is not the fetch particularly, it's the "sneak in completelly different repo". This attack should be protected enough earlier, not be something we work around during the fetch.
is there some way to make p2 verbosely log where it is downloading each artifact from?
I don't think there is something built-in p2; but maybe ECF that is used under the hood has some logging capabilities.
from p2.
Ok, I'm no security expert so let's not follow that angle further. I just thought I saw article about something like this already happening somewhere so I brought it up.
Say I wanted to disable that optimization for any reason whatsoever - is there some option/flag I could use to do that? I want strictly locations from the target file to be used and potentially also local bundle pool. Currently I'm seeing the optimization not just for file://
URIs as @merks wrote but also for remote repos.
If this is currently not possible would you consider implementing this feature request?
from p2.
There is no support for such a thing as far as I can see. It's not been my experience that p2 is installing artifacts from non-local sites either, so I wonder about that...
I doubt this issue is a big priority for anyone in particular. Would you consider contributing such a feature yourself or sponsoring someone to contribute it on your behalf?
from p2.
Should this be moved to PDE? I think the code in question is located in PDE. I also have seen such unexpected access to update sites which are no longer part of the target platform and agree that this is not correct behavior.
cc @HannesWell
from p2.
One of the classes in question is this one:
org.eclipse.equinox.internal.p2.engine.DownloadManager.start(IProgressMonitor)
The behavior is that p2 is generally trying to avoid downloading from a remote URI any artifact that is available via file: as well.
from p2.
Related Issues (20)
- Unlikely argument type HOT 2
- Bundles placed to "linked" locations not found since 4.31 HOT 26
- Getting error "Problems downloading artifact: osgi.bundle,com.sun.jna,5.13.0.v20230812-1000. The signature is invalid for current content", when exporting product for simple target for Eclipse 4.30 HOT 2
- UpdateSitePublisher -addJREIU argument doesn't add current JVM HOT 1
- Jenkins builds fail with Java heap space
- P2 is not supporting the effective directive properly HOT 2
- unsigned jar files flagged as untrusted even if the content is non-code HOT 13
- Updating a touchpoint action and calling it calls the previous version of the action HOT 7
- Broken Java 11 Tycho Build due to new org.eclipse.equinox.common 3.19 getting picked up HOT 2
- Enhance p2 director with "addJREIU" option HOT 13
- Do not show error popup on failed automatic update checks HOT 1
- Migrate wiki pages to repo HOT 7
- Overhaul documentation on p2 director application HOT 3
- "Verify provisioning operation is compatible with currently running JRE" is not working HOT 7
- API error on org.eclipse.equinox.p2.core HOT 2
- redirect configuration / p2 runtime data to non-default location
- A "org.eclipse.equinox.p2.transport.javahttpclient" transport using directly Java HTTP client or OSGi services HOT 9
- p2 director does not handle GOAWAY gracefully HOT 11
- Incorrect usage of File.renameTo() in CacheManager HOT 10
- IRepository.PROP_COMPRESSED is confusing
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from p2.