Skip to content
This repository has been archived by the owner on Jan 8, 2024. It is now read-only.

If Etag match, also check digest if required #193

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

gabriel
Copy link
Contributor

@gabriel gabriel commented Mar 3, 2020

If there is an ETag match, we return before digest check. I don't think this is a security issue since the digest was already checked if the destination path exists but we might as well check the digest if specified?

If there is an ETag match, we return before digest check. This is probably ok, but we might as well check the digest too if specified.
@maxtaco
Copy link
Contributor

maxtaco commented Mar 5, 2020

Hi! Thanks for the PR, can you fill me in on what the higher level goal is? Is it that your client has been downloading updates for no good reason (repeatedly?) and not applying them? If so there might be another bug to investigate.

@gabriel
Copy link
Contributor Author

gabriel commented Mar 6, 2020

Oh I was thinking about making a generic version/fork of this updater I could use in another project, and while I was poking around, noticed this scenario with etags and digests. I didn't encounter any bugs or weirdness or anything.

It seems like doing the digest check even if the etag matches is the correct behavior, even if in the keybase scenario that code path is never used? Basically when I looked at it, it seemed like an oversight on my part and I should mention it.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants