Bug 25607 - debuginfod-client: paranoid federation mode
Summary: debuginfod-client: paranoid federation mode
Status: NEW
Alias: None
Product: elfutils
Classification: Unclassified
Component: debuginfod (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Noah Sanci
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-27 22:08 UTC by Frank Ch. Eigler
Modified: 2022-07-14 16:30 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Frank Ch. Eigler 2020-02-27 22:08:40 UTC
It may be helpful to have a debuginfod_client option (env var? api?) that adds a degree of paranoia to frontend debuginfod servers that simply federate out to multiple mostly-trustworthy upstreams.  The present code simply launches the outgoing curl requests to -all- upstream servers in $DEBUGINFOD_URLS, and the first one that starts sending data back is selected as the winner.  The data from the others is thrown away.

This is fine if all the servers are trustworthy, correct, etc. etc.

With a bit of extra code, we can detect some kinds of shenanigans or errors.  One possibility is teaching the -client code to -not- choose the first upstream server as the winner, but to wait for them all to send back a definite response (subject to a timeout).  Then it can compare the responses from those servers that claimed to know the buildid/$payload.  If there is a mismatch, signal a loud error, as though there were a RAID-1 disagreement between mirrored disks.

With such checking logic in place, it is possible to proactively scan the federated server tree by mechanically looking up all "interesting" buildids.  It could permit the assembly of a semi-trusted tree of servers that still limit client exposure to wrong data.