Struct UnsafeChecksum 

pub struct UnsafeChecksum {}

What it does

Ensures that each alpm-package-source-checksum in SRCINFO data uses a safe hash function.

Why is this bad?

Upstream artifacts are validated against hash digests (see alpm-package-source-checksum) set in PKGBUILD and SRCINFO files.

Some hash functions (e.g. MD-5 and SHA-1) used for creating these hash digests are unsafe to use from a cryptographic perspective. These algorithms should be avoided to prevent hash collisions and potential abuse.

Using unsafe hash algorithms allows attackers to craft malicious artifacts that pass the checksum check. Further, attackers could swap existing artifacts with these malicious artifacts and compromise a package on (re)build.

Example

pkgbase = test
    pkgver = 1.0.0
    pkgrel = 1
    arch = x86_64
    source = https://domain.tld/testing/x86_64_test.tar.gz
    md5sums = 10245815f893d79f3d779690774f0b43

Use instead:

pkgbase = test
    pkgver = 1.0.0
    pkgrel = 1
    arch = x86_64
    source = https://domain.tld/testing/x86_64_test.tar.gz
    sha512sums = 1816c57b4abf31eb7c57a66bfb0f0ee5cef9398b5e4cc303468e08dae2702da55978402da94673e444f8c02754e94dedef4d12450319383c3a481d1c5cd90c82

Implementations

impl UnsafeChecksum

pub fn new_boxed(_: &LintRuleConfiguration) -> Box<dyn LintRule>

Create a new, boxed instance of UnsafeChecksum.

fn create_checksum_issue( &self, field_name: &str, value: &str, architecture: Option<SystemArchitecture>, ) -> LintIssue

Helper function to create a lint issue for unsafe checksum field.

Trait Implementations

impl Clone for UnsafeChecksum

fn clone(&self) -> UnsafeChecksum

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UnsafeChecksum

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Documented for UnsafeChecksum

const DOCS: &'static str = "# What it does\n\nEnsures that each [alpm-package-source-checksum] in [SRCINFO] data uses a safe hash function.\n\n# Why is this bad?\n\nUpstream artifacts are validated against hash digests (see [alpm-package-source-checksum]) set\nin [PKGBUILD] and [SRCINFO] files.\n\nSome [hash functions] (e.g. [MD-5] and [SHA-1]) used for creating these hash digests are unsafe\nto use from a cryptographic perspective. These algorithms should be avoided to prevent hash\ncollisions and potential abuse.\n\nUsing unsafe hash algorithms allows attackers to craft malicious artifacts that pass the\nchecksum check. Further, attackers could swap existing artifacts with these malicious artifacts\nand compromise a package on (re)build.\n\n# Example\n\n```ini,ignore\npkgbase = test\npkgver = 1.0.0\npkgrel = 1\narch = x86_64\nsource = https://domain.tld/testing/x86_64_test.tar.gz\nmd5sums = 10245815f893d79f3d779690774f0b43\n```\n\nUse instead:\n\n```ini,ignore\npkgbase = test\npkgver = 1.0.0\npkgrel = 1\narch = x86_64\nsource = https://domain.tld/testing/x86_64_test.tar.gz\nsha512sums = 1816c57b4abf31eb7c57a66bfb0f0ee5cef9398b5e4cc303468e08dae2702da55978402da94673e444f8c02754e94dedef4d12450319383c3a481d1c5cd90c82\n```\n\n[MD-5]: https://en.wikipedia.org/wiki/MD-5\n[PKGBUILD]: https://man.archlinux.org/man/PKGBUILD.5\n[RFC 0046]: https://rfc.archlinux.page/0046-upstream-package-sources/\n[SHA-1]: https://en.wikipedia.org/wiki/SHA-1\n[SRCINFO]: https://alpm.archlinux.page/specifications/SRCINFO.5.html\n[alpm-package-source-checksum]: https://alpm.archlinux.page/specifications/alpm-package-source-checksum.7.html\n[hash functions]: https://en.wikipedia.org/wiki/Hash_function"

The static doc comments on this type.

impl LintRule for UnsafeChecksum

fn name(&self) -> &'static str

Returns the name of this lint rule.

fn scope(&self) -> LintScope

Return the scope of this lint rule.

fn level(&self) -> Level

The severity level of this lint rule.

fn documentation(&self) -> String

Returns the full documentation for this lint rule.

fn help_text(&self) -> String

Returns the help text for this lint rule.

fn run( &self, resources: &Resources, issues: &mut Vec<LintIssue>, ) -> Result<(), Error>

Executes the linting logic and appends to list of accumulated issues.

fn scoped_name(&self) -> String

Returns the full name of this lint by combining LintRule::scope and LintRule::name as {scope}::{name}.

fn groups(&self) -> &'static [LintGroup]

Returns the static lint groups this lint rule belongs to.

fn configuration_options(&self) -> &[LintRuleConfigurationOptionName]

Returns a map of configuration options used by this lint rule.

fn extra_links(&self) -> Option<BTreeMap<String, String>>

Returns a map of additional associated links for this lint rule.