mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-11-03 22:20:28 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

convert apkcache from pickle to JSON

Browse source 
pickle can serialize executable code, while JSON is only ever pure data.
The APK cache is only ever pure data, so no need for the security risks of
pickle.  For example, if some malicious thing gets write access on the
`fdroid update` machine, it can write out a custom tmp/apkcache which would
then be executed.  That is not possible with JSON.

This does just ignore any existing cache and rebuilds from scratch. That is
so we don't need to maintain pickle anywhere, and to ensure there are no
glitches from a conversion from pickle to JSON.

closes #163
This commit is contained in:
Hans-Christoph Steiner 2018-09-03 18:07:40 +02:00
parent 74776e026f
commit 3011953d0e
6 changed files with 97 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/repo/index-v1.json
View file

@ -1,7 +1,7 @@
{
"repo": {
"timestamp": 1502845383782,
"version": 19,
"version": 20,
"name": "My First F-Droid Repo Demo",
"icon": "fdroid-icon.png",
"address": "https://MyFirstFDroidRepo.org/fdroid/repo",