3 Commits

Author	SHA1	Message	Date
Colin Walters	5ebe43859d	tests: Use "bash strict mode" ... I noticed in the static deltas tests, there were some tests that should have been under `-o pipefail` to ensure we properly propagate errors. There were a few places where we were referencing undefined variables. Overall, this is clearly a good idea IMO.	2016-01-27 11:44:10 -05:00
Giuseppe Scrivano	aea173b3f8	tests: enforce ${CMD_PREFIX} on all ostree processes ... Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>	2015-03-03 18:32:24 -05:00
Colin Walters	47610b45c2	Limit metadata to 10 MiB ... If fetching GPG-signed commits over plain HTTP, a MitM attacker can fill up the drive of targets by simply returning an enormous stream for the commit object. Related to this, an attacker can also cause OSTree to perform large memory allocations by returning enormous GVariants in the metadata. This helps close that attack by limiting all metadata objects to 10 MiB, so the initial fetch will be truncated. But now the attack is only slightly more difficult as the attacker will have to return a correctly formed commit object, then return a large stream of < 10 MiB dirmeta/dirtree objects. https://bugzilla.gnome.org/show_bug.cgi?id=725921	2014-05-27 14:15:27 -04:00