Skip to content

Commit

Permalink
First attempt at technical documentation for header regions
Browse files Browse the repository at this point in the history
There are all sorts of details missing still, but it's a start.
  • Loading branch information
pmatilai committed Jan 19, 2024
1 parent 8a2f66a commit e587e19
Show file tree
Hide file tree
Showing 4 changed files with 43 additions and 93 deletions.
1 change: 0 additions & 1 deletion docs/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ install(FILES
manual/file_triggers.md
manual/format_v3.md
manual/format_v4.md
manual/hregions.md
manual/index.md
manual/large_files.md
manual/lua.md
Expand Down
43 changes: 43 additions & 0 deletions docs/manual/format_header.md
Original file line number Diff line number Diff line change
Expand Up @@ -158,3 +158,46 @@ could start at byte 589, byte that is an improper boundary for an INT32.
As a result, 3 null bytes are inserted and the date for the SIZE actually
starts at byte 592: "00 09 9b 31", which is 629553).

## Immutable regions

RPM v4 introduced the concept of contiguous immutable header regions
which allow the original header data to be digitally verified even after
modifying the data. This is done with special tags which keep track
of a contiguous region (i.e. the original header).

These region tags are technically like any other tag with associated
binary data and thus fully backwards compatible. The special part is the
interpretation of the region tag data, called the trailer, which looks
like a Index Entry despite residing in the Data section,

A region Index Entry looks like this:

Field | Value
--------|------
tag | 62 or 63 (HEADERIMMUTABLE or HEADERSIGNATURES)
type | BIN
offset | Offset to the region trailer in the Data section
count | 16

And the region trailer in the Data section:

Field | Value
--------|------
tag | Must equal the Index Entry (ie 62 or 63)
type | BIN
offset | Size of the region entries in the Index
count | 16

The number of entries in the region (aka region index length) can thus be
calculated as `ril = -offset / sizeof(struct index_entry)`.

When reading a package from disk, the number of region entries is expected
to be the same as the index length in the Intro. However when a package
is installed, extra data such as the install time is added to the header,
that data falls outside the otherwise invisible region line in the index.
These tags outside the immutable region are called "dribbles" in the RPM
lore.

With the aid of regions and dribbles, it's possible to add, modify and
delete header data but still pull out the original contents at will.
It gets complicated.
91 changes: 0 additions & 91 deletions docs/manual/hregions.md

This file was deleted.

1 change: 0 additions & 1 deletion docs/manual/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,6 @@ title: rpm.org - RPM Reference Manual

### Package Format
* [RPM v4 file format](format_v4.md)
* [RPM v4 header regions](hregions.md)
* [RPM v4 signatures and digests](signatures_digests.md)
* [RPM v3 file format](format_v3.md) (obsolete)

Expand Down

0 comments on commit e587e19

Please sign in to comment.