Tahoe: Avoid verifying hash after download, since tahoe does sufficient verification...

See my comment in the next commit for some details about why
Verified needs a hash with preimage resistance. As far as tahoe goes,
it's fully cryptographically secure.

I think that bup could also return Verified. However, the Retriever
interface does not currenly support that.

diff --git a/CHANGELOG b/CHANGELOG
index 72011107247819c951eac315b8c4432dc88522b6..c8ed840b86157742cb29c89a25be007063f459d7 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -22,6 +22,8 @@ git-annex (8.20210128) UNRELEASED; urgency=medium
   * Fix build on openbsd.
     Thanks, James Cook for the patch.
   * Include libkqueue.h file needed to build the assistant on BSDs.
+  * Tahoe: Avoid verifying hash after download, since tahoe does sufficient
+    verification itself.
 
  -- Joey Hess <id@joeyh.name>  Thu, 28 Jan 2021 12:34:32 -0400
 

diff --git a/Remote/BitTorrent.hs b/Remote/BitTorrent.hs
index b0ae33fbed6f88d1b32f5fe6f9aaa323fafbed42..723c0896c5caf892b9d348c3c913361a756823a0 100644 (file)
--- a/Remote/BitTorrent.hs
+++ b/Remote/BitTorrent.hs
@@ -99,6 +99,9 @@ gen r _ rc gc rs = do
 downloadKey :: Key -> AssociatedFile -> FilePath -> MeterUpdate -> Annex Verification
 downloadKey key _file dest p = do
        get . map (torrentUrlNum . fst . getDownloader) =<< getBitTorrentUrls key
+       -- While bittorrent verifies the hash in the torrent file,
+       -- the torrent file itself is downloaded without verification,
+       -- so the overall download is not verified.
        return UnVerified
   where
        get [] = giveup "could not download torrent"

diff --git a/Remote/Tahoe.hs b/Remote/Tahoe.hs
index 172c32c5efb81bc83010de9475c285475eab5d1f..22616c53c15e81573deee55b2703cc516f2ba0ca 100644 (file)
--- a/Remote/Tahoe.hs
+++ b/Remote/Tahoe.hs
@@ -147,7 +147,9 @@ store rs hdl k _f _p = sendAnnex k noop $ \src ->
 retrieve :: RemoteStateHandle -> TahoeHandle -> Key -> AssociatedFile -> FilePath -> MeterUpdate -> Annex Verification
 retrieve rs hdl k _f d _p = do
        go =<< getCapability rs k
-       return UnVerified
+       -- Tahoe verifies the content it retrieves using cryptographically
+       -- secure methods.
+       return Verified
   where
        go Nothing = giveup "tahoe capability is not known"
        go (Just cap) = unlessM (liftIO $ requestTahoe hdl "get" [Param cap, File d]) $

diff --git a/Types/Remote.hs b/Types/Remote.hs
index 0acdabd14e6726f563e0710a136f9918b12fd50f..5286b26ece7f17ac1729b987301273cee52072c6 100644 (file)
--- a/Types/Remote.hs
+++ b/Types/Remote.hs
@@ -197,7 +197,9 @@ data Verification
        -- ok, so if verification is disabled, don't verify it
        | Verified
        -- ^ Content was verified during transfer, so don't verify it
-       -- again.
+       -- again. The verification does not need to use a
+       -- cryptographically secure hash, but the hash does need to
+       -- have preimage resistance.
        | MustVerify
        -- ^ Content likely to have been altered during transfer,
        -- verify even if verification is normally disabled