Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • diffoscope diffoscope
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 145
    • Issues 145
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 12
    • Merge requests 12
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Reproducible BuildsReproducible Builds
  • diffoscopediffoscope
  • Issues
  • #211
Closed
Open
Issue created Aug 17, 2020 by Justus Winter@justus-guest

Detection of OpenPGP data is not robust

OpenPGP messages are a container for arbitrary data, as such, I expected diffoscope to descend into it and compare the contents, but that is not what I observe. Consider:

% diffoscope a.tar b.tar
--- a.tar
+++ b.tar
├── file list
│ @@ -1 +1 @@
│ --rw-r--r--   0 teythoon  (1000) teythoon  (1000)        0 2020-08-17 16:21:02.000000 foobar
│ +-rw-r--r-x   0 teythoon  (1000) teythoon  (1000)        0 2020-08-17 16:21:02.000000 foobar

But no dice when inspecting these tarballs inside signed (and compressed) OpenPGP messages:

% diffoscope a.tar.pgp b.tar.pgp
--- a.tar.pgp
+++ b.tar.pgp
@@ -1,31 +1,31 @@
 00000000: a301 9bc0 cbcc c0c1 d871 a7ce d822 be52  .........q...".R
-00000010: 9671 ad06 7712 6ba2 5e49 6251 bcd5 ba2d  .q..w.k.^IbQ...-
-00000020: 69f9 f949 8945 0c34 0506 4060 6662 02a2  i..I.E.4..@`fb..
+00000010: 9671 ad06 7712 6b92 5e49 6251 bcd5 baa3  .q..w.k.^IbQ....
+00000020: 69f9 f949 8945 0c34 0506 4060 6662 0aa2  i..I.E.4..@`fb..
 00000030: 0dcd 4d0d 9069 1860 3034 3637 3433 3532  ..M..i.`04674352
-00000040: 3734 3563 3030 3432 3533 6050 30a0 adb3  745c004253`P0...
+00000040: 3734 3563 3030 3432 3533 6450 30a0 adb3  745c004253dP0...
 00000050: 20a0 b418 1812 0a0a 0c25 a995 2519 f9f9   ........%..%...
 00000060: 79b8 d411 921f 05a3 6014 8c82 5130 0a46  y.......`...Q0.F
 00000070: c128 1805 a360 148c 8251 300a 46c1 2818  .(...`...Q0.F.(.
 00000080: 05a3 6014 8c82 5130 0a46 c128 1805 a360  ..`...Q0.F.(...`
 00000090: 148c 8251 300a 46c1 2818 05a3 6014 8c82  ...Q0.F.(...`...
 000000a0: 5130 0ae8 083a 198d 5918 1839 1864 c514  Q0...:..Y..9.d..
 000000b0: 5954 b3fc 429f 2cd7 9dbe 5625 e379 c79d  YT..B.,...V%.y..
-000000c0: 3a63 8bf8 4a59 56a6 78ab 755b 18b8 3805  :c..JYV.x.u[..8.
-000000d0: 6022 a5fc ecff 23e6 7f4d 9b1f cc95 a77b  `"....#..M.....{
-000000e0: a741 77c3 9aeb cc96 f2bd df73 762d fdaa  .Aw........sv-..
-000000f0: 912c f12d 82f7 e8a1 cefa 4391 b566 3bf4  .,.-......C..f;.
-00000100: 446f 6e36 daea c5f7 f981 e6a5 d57b 7d8c  Don6.........{}.
-00000110: fe9c 9e14 1621 b65d 68ad 8ce5 8e44 0b39  .....!.]h....D.9
-00000120: 7ddf f3a7 f5e2 266e 76d6 3268 3b7e fa67  }.....&nv.2h;~.g
-00000130: eac4 5dc1 3932 2553 a72f 3acd 5db0 b4b6  ..].92%S./:.]...
-00000140: 3389 41bc 53f0 c56b 9f05 aeb9 f516 de02  3.A.S..k........
-00000150: 9dcb 5ac5 7438 32d5 7d1b 1ab7 3695 3e5a  ..Z.t82.}...6.>Z
-00000160: 6560 3149 71a3 32a3 87ed 8a2e 8dbb 5e2c  e`1Iq.2.......^,
-00000170: ef65 1f35 76fe b831 6f81 cf15 ee19 2f1b  .e.5v..1o...../.
-00000180: 4556 a7b4 1a32 3f35 60b8 2273 c1e5 ddf9  EV...2?5`."s....
-00000190: 7fab be36 c872 f05a 6578 cfbd 75e5 f963  ...6.r.Zex..u..c
-000001a0: fd88 be93 5e81 53f6 6dd8 5bd6 c55f ebaa  ....^.S.m.[.._..
-000001b0: bf46 6a55 98f5 b9fe 597b a6ec 4ff8 14b4  .FjU....Y{..O...
-000001c0: e6d9 8592 b0be 9cc4 6da7 1e29 dfee 7d71  ........m..)..}q
-000001d0: ffdc f4bb 4f2c 7ef0 a6ef 7c50 2e21 f148  ....O,~...|P.!.H
-000001e0: 6351 6b05 00                             cQk..
+000000c0: 3a63 8bf8 4a59 56a6 78ab 7547 19b8 3805  :c..JYV.x.uG..8.
+000000d0: 6022 f75a 3818 666d fca4 cf1d a6b4 f7d7  `".Z8.fm........
+000000e0: 1e6d ebe3 fb7b bf5e 6029 db17 d8cd 3c5b  .m...{.^`)....<[
+000000f0: d35a 71f5 e923 5357 f02f f9ac 326d cb0f  .Zq..#SW./..2m..
+00000100: 65eb f57f 1ccc 665f 2e17 58d4 ff83 5d89  e.....f_..X...].
+00000110: 755e 88ef c43e fb1c 9d1b d1e6 460a 66a9  u^...>......F.f.
+00000120: 5752 ce99 5bde 72b8 7ab9 3ea0 f166 d455  WR..[.r.z.>..f.U
+00000130: dbc6 57b7 3539 fc26 4d59 79a7 af60 efad  ..W.59.&MYy..`..
+00000140: 2617 6537 0976 d68a 8349 7fca eeb7 7f9f  &.e7.v...I......
+00000150: f297 e7a3 7b75 eec9 d93f 8faf 3460 6c9c  ....{u...?..4`l.
+00000160: a9fe 6b7a 54b1 a5ea e116 1e1f a1e3 02ab  ..kzT...........
+00000170: 4fce 3fee fa94 f5f5 548d e36d 452f d374  O.?.....T..mE/.t
+00000180: fc77 e86f 918c eb16 8d9a 79e4 6869 8671  .w.o......y.hi.q
+00000190: 6d88 e132 973c 7b3d 8543 61ac 9d4e a257  m..2.<{=.Ca..N.W
+000001a0: 4f8b ed59 f0ee e5af e683 f78e fcf0 ac4a  O..Y...........J
+000001b0: 3d5d a7cc 30e3 3ef3 96a5 8b53 b927 eb73  =]..0.>....S.'.s
+000001c0: 4f9c 5a6a 7923 73f7 af76 f6fb 3bc2 1c4e  O.Zjy#s..v..;..N
+000001d0: 2cda e578 76fb 9497 b117 16b8 4faf 38ab  ,..xv.......O.8.
+000001e0: 7dcf fb81 3c00                           }...<.

a.tar

a.tar.pgp

b.tar

b.tar.pgp

Edited Aug 18, 2020 by Justus Winter
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking