From f35f98cfafaaa359fe2140e99264dbfc7bd02bc0 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Sep 27 2024 20:33:24 +0000
Subject: [PATCH 1/3] fix store offsets when duplicate tags are present


For context, see https://pagure.io/koji/issue/4200

If an rpm has duplicate tags in a header, Koji would miscalculate the
start of that data store.

---

diff --git a/koji/__init__.py b/koji/__init__.py
index 7a8111e..013e274 100644
--- a/koji/__init__.py
+++ b/koji/__init__.py
@@ -687,6 +687,7 @@ class RawHeader(object):
         data = [_ord(x) for x in self.header[8:12]]
         il = multibyte(data[:4])
         dl = multibyte(data[4:8])
+        self._store = 16 + il * 16
 
         # read the index (starts at offset 16)
         index = {}
@@ -704,12 +705,8 @@ class RawHeader(object):
 
     def dump(self, sig=None):
         print("HEADER DUMP:")
-        # calculate start of store
-        il = len(self.index)
-        store = 16 + il * 16
-        # print("start is: %d" % start)
-        # print("index length: %d" % il)
-        print("Store at offset %d (%0x)" % (store, store))
+        store = self._store
+        print("Store at offset %d (0x%0x)" % (store, store))
         # sort entries by offset, dtype
         # also rearrange: tag, dtype, offset, count -> offset, dtype, tag, count
         order = sorted([(x[2], x[1], x[0], x[3]) for x in six.itervalues(self.index)])
@@ -868,9 +865,7 @@ class RawHeader(object):
     def _getitem(self, dtype, offset, count, decode=None):
         if decode is None:
             decode = self.decode
-        # calculate start of store
-        il = len(self.index)
-        store = 16 + il * 16
+        store = self._store
         pos = store + offset
         if dtype >= 2 and dtype <= 5:
             values = []

From 64585b9d3b585be219de0114ab031fb9fe2fcde7 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Sep 27 2024 20:43:02 +0000
Subject: [PATCH 2/3] show dups in header dump


---

diff --git a/koji/__init__.py b/koji/__init__.py
index 013e274..eeaade6 100644
--- a/koji/__init__.py
+++ b/koji/__init__.py
@@ -687,10 +687,10 @@ class RawHeader(object):
         data = [_ord(x) for x in self.header[8:12]]
         il = multibyte(data[:4])
         dl = multibyte(data[4:8])
-        self._store = 16 + il * 16
 
         # read the index (starts at offset 16)
-        index = {}
+        index = []
+        tag_index = {}
         for i in range(il):
             entry = []
             for j in range(4):
@@ -699,9 +699,14 @@ class RawHeader(object):
                 entry.append(multibyte(data))
 
             # print("Tag: %d, Type: %d, Offset: %x, Count: %d" % tuple(entry))
-            index[entry[0]] = entry
+            index.append(entry)
+            tag_index[entry[0]] = entry
+            # in case of duplicate tags, last one wins
+
         self.datalen = dl
-        self.index = index
+        self._store = 16 + il * 16
+        self._index = index  # list
+        self.index = tag_index  # dict
 
     def dump(self, sig=None):
         print("HEADER DUMP:")
@@ -709,7 +714,7 @@ class RawHeader(object):
         print("Store at offset %d (0x%0x)" % (store, store))
         # sort entries by offset, dtype
         # also rearrange: tag, dtype, offset, count -> offset, dtype, tag, count
-        order = sorted([(x[2], x[1], x[0], x[3]) for x in six.itervalues(self.index)])
+        order = sorted([(x[2], x[1], x[0], x[3]) for x in self._index])
         # map some rpmtag codes
         tags = {}
         if rpm:

From ae3c28fb8970079978950e6aede5016ff2cde1c0 Mon Sep 17 00:00:00 2001
From: Mike McLean <mikem@redhat.com>
Date: Sep 27 2024 20:56:43 +0000
Subject: [PATCH 3/3] fix misleading comment


---

diff --git a/kojihub/kojihub.py b/kojihub/kojihub.py
index 28d4c74..9703af4 100644
--- a/kojihub/kojihub.py
+++ b/kojihub/kojihub.py
@@ -8183,12 +8183,7 @@ def add_rpm_sig(an_rpm, sighdr):
         if not sigkey:
             sigkey = rawhdr.get(koji.RPM_SIGTAG_RSA)
     else:
-        # In older rpms, this field in the signature header does not actually match
-        # sigmd5 (I think rpmlib pulls it from SIGTAG_GPG). Anyway, this
-        # sanity check fails incorrectly for those rpms, so we fall back to
-        # a somewhat more expensive check.
-        # ALSO, for these older rpms, the layout of SIGTAG_GPG is different too, so
-        # we need to pull that differently as well
+        # Double check using rpm in case we have somehow misread
         rpm_path = "%s/%s" % (builddir, koji.pathinfo.rpm(rinfo))
         sigmd5, sigkey = _scan_sighdr(sighdr, rpm_path)
         sigmd5 = koji.hex_string(sigmd5)