mirror of
git://git.sv.gnu.org/emacs.git
synced 2026-02-17 01:34:21 +00:00
bcde5f86c5
Expiring package metadata is done by checking the timestamp in package archive file. This is intended to limit the effectiveness of a replay attack. The onus is on the package archives to implement a secure and reasonable policy. (Debian uses 7 days before metadata expires.) Together with package checksums, this adds sufficient protection against metadata replay attacks. (Bug#19479) * lisp/emacs-lisp/package.el (package-check-timestamp): New defcustom. (bad-timestamp): New error. (package--parse-header-from-buffer) (package--parse-valid-until-from-buffer) (package--parse-last-updated-from-buffer) (package--archive-verify-timestamp) (package--archive-verify-not-expired) (package--compare-archive-timestamps) (package--check-archive-timestamp): New defuns. (package--download-one-archive): Check timestamp of the 'archive-contents' file using above functions. It is only checked if it exists, which makes this change backwards compatible. * lisp/calendar/iso8601.el (iso8601-parse): Add autoload cookie. * test/lisp/emacs-lisp/package-tests.el (package-test-parse-valid-until-from-buffer) (package-test-parse-last-updated-from-buffer) (package-test-archive-verify-timestamp) (package-test-check-archive-timestamp) (package-test-check-archive-timestamp/not-expired) (package-test-check-archive-timestamp/expired): New tests. * test/lisp/emacs-lisp/package-resources/archives/older/archive-contents: * test/lisp/emacs-lisp/package-resources/archives/newer/archive-contents: New files. * doc/lispref/package.texi (Package Archives, Archive Web Server): Document how to increase the security of a package archive using checksums, signing and timestamps. |
||
|---|---|---|
| .. | ||
| charsets | ||
| e | ||
| forms | ||
| gnus | ||
| images | ||
| nxml | ||
| org | ||
| refcards | ||
| schema | ||
| srecode | ||
| themes | ||
| tutorials | ||
| AUTHORS | ||
| CALC-NEWS | ||
| ChangeLog.1 | ||
| compilation.txt | ||
| COPYING | ||
| DEBUG | ||
| DEVEL.HUMOR | ||
| DISTRIB | ||
| edt-user.el | ||
| emacs-buffer.gdb | ||
| emacs-mail.desktop | ||
| emacs.appdata.xml | ||
| emacs.desktop | ||
| emacs.icon | ||
| emacs.service | ||
| emacsclient.desktop | ||
| enriched.txt | ||
| ERC-NEWS | ||
| ETAGS.EBNF | ||
| ETAGS.README | ||
| future-bug | ||
| gnus-tut.txt | ||
| grep.txt | ||
| HELLO | ||
| HISTORY | ||
| JOKES | ||
| MACHINES | ||
| MH-E-NEWS | ||
| NEWS | ||
| NEWS.1-17 | ||
| NEWS.18 | ||
| NEWS.19 | ||
| NEWS.20 | ||
| NEWS.21 | ||
| NEWS.22 | ||
| NEWS.23 | ||
| NEWS.24 | ||
| NEWS.25 | ||
| NEWS.26 | ||
| NEWS.27 | ||
| NEXTSTEP | ||
| NXML-NEWS | ||
| ORG-NEWS | ||
| package-keyring.gpg | ||
| PROBLEMS | ||
| ps-prin0.ps | ||
| ps-prin1.ps | ||
| publicsuffix.txt | ||
| README | ||
| rgb.txt | ||
| ses-example.ses | ||
| spook.lines | ||
| TERMS | ||
| TODO | ||
| w32-feature.el | ||
| yow.lines | ||
This directory contains the architecture-independent files used by or with Emacs. This includes some text files of documentation for GNU Emacs or of interest to Emacs users, and the file of dumped docstrings for Emacs functions and variables. COPYRIGHT AND LICENSE INFORMATION FOR IMAGE FILES File: emacs.icon Author: Sun Microsystems, Inc Copyright (C) 1999, 2001-2020 Free Software Foundation, Inc. License: GNU General Public License version 3 or later (see COPYING)