Skip to main content
aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMykola Nikishov2015-11-03 23:01:31 +0000
committerAlexander Kurtakov2018-03-01 09:50:32 +0000
commit9e5ac9146a99bc132960034e5312f1b449a31fd6 (patch)
treea4f3008f1e9ecf7be580989a9135babc28437965 /bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF
parente92e31abc7ed83117b9cd25b4026531b4ae47064 (diff)
downloadrt.equinox.p2-9e5ac9146a99bc132960034e5312f1b449a31fd6.tar.gz
rt.equinox.p2-9e5ac9146a99bc132960034e5312f1b449a31fd6.tar.xz
rt.equinox.p2-9e5ac9146a99bc132960034e5312f1b449a31fd6.zip
Bug 423715 - Support multiple algorithms for artifact checksumsI20180301-2000
Developer of p2-based software should be able to check integrity of artifact checksums using any MessageDigest implementation available, at his own discretion, without ever touching p2 internals. For the purpose of this bug, limit enabled checksum algorithms to: - MD5 (legacy one, deprecated now, for backward compatibility only) - SHA-256 (more collision-resistant than MD5) See artifactChecksums.exsd for more details. First, encode ID of the checksum algorithm into the name of the property itself so that artifact descriptor now may look like: <artifact classifier='binary' id='testKeyId' version='1.2.3'> <properties size='6'> <property name='download.md5' value='b3788632488d48b850255acf68669651'/> <property name='artifact.md5' value='b3788632488d48b850255acf68669651'/> <property name='download.checksum.sha-256' value='d594816b995d1689c2dfc97dc244859abe6bdb9ebeb4b396e401afd85a97ee16'/> <property name='download.checksum.whirlpool' value='e4f3ece3d3f289cc2686a68f0b1b5a2d03da3a8ccdc3cd6d03209e4c789af724c8fa915bb890079e1abe78df44875cec132885dd6ae1176eed7938dfb3c7b551'/> <property name='artifact.checksum.sha-256' value='d594816b995d1689c2dfc97dc244859abe6bdb9ebeb4b396e401afd85a97ee16'/> <property name='artifact.checksum.tiger' value='462a72a1a593b9e2de8721b8d79335fd03e974f2e2e1f35a'/> </properties> </artifact> Prefix helps to avoid conflicts with other, not checksum-related, properties. To find checksums of specific type, we need all properties with prefix 'artifact.checksum.', Extracting checksum id from the name of the property is also trivial. Store these prefixes in IArtifactDescriptor's DOWNLOAD_CHECKSUM and ARTIFACT_CHECKSUM. ChecksumUtilities provides internal API to deal with properties. Second, map ID of checksum algorithm to the name of MessageDigest implementation with a contribution to a new extension point org.eclipse.equinox.p2.artifact.repository.artifactChecksums: <extension point="org.eclipse.equinox.p2.artifact.repository.artifactChecksums"> <artifactChecksum algorithm="SHA-256" id="sha-256" ... /> </extension> Number of actual checksums in artifact descriptor depends on the configuration of the application that created such descriptor because p2 will: - handle MD5 checksums as usual, preserving backward compatibility - calculate other checksums using extensions that contribute to artifactChecksums extension point Last, we use id of specific checksum to get MessageDigest instance with getInstance(String). There is a number of standalone applications (like MirrorApplication) and Ant tasks (like ValidateTask) that allow user to chose specific comparator by id and ArtifactComparatorFactory is responsible for instantiating it. Legacy MD5 comparator requires no special configuration while the new ArtifactChecksumComparator is more generic and needs some parameters to instantiate. ArtifactComparatorFactory handles this by accepting fake comparator id - concatenated ArtifactChecksumComparator's id and checksum algorithm id. In other words, to compare artifacts using SHA-256 algorithm use 'org.eclipse.equinox.artifact.comparator.checksum.sha-256' as comparator id. We generate, consume and compare artifact checksums using all enabled algorithms. Ideally, configuration options should provide more control for both repository publisher and p2 client like: - a priority (compare with SHA-512 first, then SHA-256 and, finally, MD5) - skip specific checksum (do not use MD5 even if provided) - mandatory checksum (require Whirlpool and it's an error if its not available) While I have no good solution for this right now, there are some configuration options provided. Also, number of new enabled checksum algorithms is limited to SHA-256 only (more checksums = more reasons to fail = more reasons to disable). To turn checksum verification off completely: - for p2 client, use property 'eclipse.p2.checksums.disable' (see SimpleArtifactRepository.CHECKSUMS_ENABLED constant). - for p2 publisher, the old PublisherInfo's setArtifactOptions(int) and IPublisherInfo.A_NO_MD5 still could be used. To disable MD5 checksums only, existing properties 'eclipse.p2.MD5Check' and 'eclipse.p2.MD5ArtifactCheck' still can be used. Change-Id: Iacd267e13d5d096694001d34cafbaea5451e7157 Signed-off-by: Mykola Nikishov <mn@mn.com.ua>
Diffstat (limited to 'bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF')
-rw-r--r--bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF1
1 files changed, 1 insertions, 0 deletions
diff --git a/bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF b/bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF
index 4e24d6fe3..657a43558 100644
--- a/bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF
+++ b/bundles/org.eclipse.equinox.p2.artifact.repository/META-INF/MANIFEST.MF
@@ -7,6 +7,7 @@ Bundle-Activator: org.eclipse.equinox.internal.p2.artifact.repository.Activator
Bundle-Vendor: %providerName
Bundle-Localization: plugin
Export-Package: org.eclipse.equinox.internal.p2.artifact.processing;x-friends:="org.eclipse.equinox.p2.artifact.processors,org.eclipse.equinox.p2.artifact.optimizers",
+ org.eclipse.equinox.internal.p2.artifact.processors.checksum;x-friends:="org.eclipse.equinox.p2.publisher",
org.eclipse.equinox.internal.p2.artifact.processors.md5;x-internal:=true,
org.eclipse.equinox.internal.p2.artifact.processors.pack200;x-friends:="org.eclipse.equinox.p2.artifact.processors,org.eclipse.equinox.p2.artifact.optimizers",
org.eclipse.equinox.internal.p2.artifact.repository;

Back to the top