smart does not gracefully handle invalid Releases/Packages files

[Joseph Salisbury]

The Landscape Client, which uses smart, fails with the following error at times:

error: Channel 'lucid-updates - main restricted universe multiverse' signed with unknown key

This causes the Landscape Client to break package related operations, with messages such as these in package-reporter.log:

2011-09-20 10:32:12,428 WARNING [MainThread] '/usr/lib/landscape/smart-update'
exited with status 1 (error: Channel 'stable - main' signed with unknown key

This issue is not restricted to a particular mirror/proxy/package repository.

This issue can be worked around using:

$ sudo rm -vrf /var/lib/smart/*
$ sudo /usr/share/smart/smart update

The issue appears to be that smart does not verify if the file it has downloaded is a valid Releases{.gpg} file and caches it regardless. Once this is placed in /var/lib/smart/channels/ - this is not removed unless it is rm -f'ed.

APT verifies that a Release/Package file is valid by seeing if it can be RFC822 parsed. It will simply discard and delete that which cannot be parsed. This is the code it uses for this:

$ bzr diff -r 2125..2127 http://bzr.debian.org/bzr/apt/apt/debian-sid | less

Attached is an example of a corrupted smart directory where:

- var/lib/smart/channels/aptsync-55bfeb83793f2e1e1f12f59e614ddaa1%%http:__gb.archive.ubuntu.com_ubuntu_dists_lucid_Release.gpg

Is an HTML redirect page which has been cached.

[Andreas Hasenack (ahasenack)]

There is a smart package currently in {lucid,maverick,natty}-proposed that catches http error codes. One such case was a 401 error (unauthorized), which was also being downloaded as a Release file.

You nominated this bug for oneiric, are you sure it happens there as well? I ask because the fix which was backported to lucid, maverick and natty is already present in oneiric.

[Jonathan Davies (jpds)]

We have reason to believe that this bug is unrelated to proxy/authorization 401 errors, as some of the people affected are not behind a proxy.

What we are requesting is that smart verifies that what it has downloaded is sane, and an expected result; just as APT does.

I have not tested this in oneiric (though the only difference in the related code appears to have been the trustdb additions in 1.4).

[Damiön la Bagh (kat-amsterdam)]

This happens on a Fresh install of 10.04.4 with a fresh install of smart.
Since it's not recommended to upgrade to 12.04.0 until 12.04.1 this should really be fixed.

command was

sudo smart --gui update
sudo smart --gui upgrade