Bug#858431: strip-nondeterminism does not normalize Unix ownership from zip archives

Mike Swanson mikeonthecomputer at gmail.com
Wed Mar 22 10:48:02 UTC 2017


Package: strip-nondeterminism
Version: 0.031-1

Zip archives may contain Unix metadata about its member files, including
ownership, mode, and so forth.

strip-nondeterminism fails to correct for ownership, allowing for
archives to be created and maintained with basically arbitrary and
unpredictable UIDs/GIDs, normally the UIDs/GIDs of the user the archive
is being created under.  Example run (starting out with an empty
directory):

chungy at turanga:sn$ fakeroot
root at turanga:sn# mkdir 1 2
root at turanga:sn# touch {1,2}/{root,user}
root at turanga:sn# chown 1000:1001 1/user && chown 1001:1002 2/user
root at turanga:sn# chmod 700 1/root 2/root
root at turanga:sn# zip -qj 1.zip 1/root 1/user && zip -qj 2.zip 2/user
2/root
root at turanga:sn# bsdtar -tvf 1.zip
-rwx------  0 0      0           0 Mar 22 03:44 root
-rw-r--r--  0 1000   1001        0 Mar 22 03:44 user
root at turanga:sn# bsdtar -tvf 2.zip
-rw-r--r--  0 1001   1002        0 Mar 22 03:44 user
-rwx------  0 0      0           0 Mar 22 03:44 root
root at turanga:sn# strip-nondeterminism ?.zip
root at turanga:sn# bsdtar -tvf 1.zip
-rwxr-xr-x  0 0      0           0 Mar 22 03:44 root
-rw-r--r--  0 1000   1001        0 Mar 22 03:44 user
root at turanga:sn# bsdtar -tvf 2.zip
-rwxr-xr-x  0 0      0           0 Mar 22 03:44 root
-rw-r--r--  0 1001   1002        0 Mar 22 03:44 user

What I expect to see, and believe should happen, is all UIDs and GIDs in
the zip archive become 0, owned by root.



More information about the Reproducible-builds mailing list