chainguard-dev/apko

Incorrect hashes in /lib/apk/db/triggers

Closed this issue · 0 comments

xnox commented

Currently the contents of triggers starts with package identifier hash, followed by paths they trigger.

However, that hash is not correct as it is not prefixed by Q1 to make it encoded sha1, versus older encoded md5.

Observe that reinstalling glibc causes the triggers database to change, or doing sed on it makes things work, and also that currently hashes do not match the database:

# cat /lib/apk/db/triggers 
svwEotg0cosWmMSmj/Df0tgRzxo= /lib /lib64 /usr/lib /usr/lib64
QvnHw1EiaN8Dl/XTzKoL1eZCYjE= /bin /sbin /usr/bin /usr/sbin
# grep -e '^$' -e 'C:' -e 'P:' /lib/apk/db/install
ed | grep -B1 -e svwE -e Qvn
P:glibc
C:Q1svwEotg0cosWmMSmj/Df0tgRzxo=
--
P:busybox
C:Q1QvnHw1EiaN8Dl/XTzKoL1eZCYjE=

0ee466b72c73:/work/packages# sed 's|^|Q1|' -i /lib/apk/db/triggers 
0ee466b72c73:/work/packages# apk add linux-pam
fetch https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz
(1/1) Installing linux-pam (1.6.1-r1)
Executing glibc-2.40-r2.trigger
Executing busybox-1.37.0-r0.trigger
OK: 16 MiB in 15 packages

Performing sed to append Q1 to every line in triggers causes for them to be executed.

This can also be tested with

# apk info --triggers glibc
glibc-2.40-r2 triggers:
/lib
/lib64
/usr/lib
/usr/lib64

which in fresh container without sed-ing in Q1 is empty, but reports correct things after sed