Re: scratch/package-security bcde5f8 2/2: Support expiration of metadata by package archives

[Stefan Monnier <monnier@iro.umontreal.ca>]

> @@ -449,6 +458,7 @@ synchronously."
>  (define-error 'bad-size "Package size mismatch" 'package-error)
>  (define-error 'bad-signature "Failed to verify signature" 'package-error)
>  (define-error 'bad-checksum "Failed to verify checksum" 'package-error)
> +(define-error 'bad-timestamp "Failed to verify timestamp" 'package-error)

Hmm, these errors should all have a `package-` prefix.

>  \f
>  ;;; `package-desc' object definition
> @@ -1812,6 +1822,100 @@ Once it's empty, run `package--post-download-archives-hook'."
>      (message "Package refresh done")
>      (run-hooks 'package--post-download-archives-hook)))
>  
> +(defun package--parse-header-from-buffer (header name)
> +  "Find and return \"archive-contents\" HEADER for archive NAME.
> +This function assumes that the current buffer contains the
> +\"archive-contents\" file.
> +
> +A valid header looks like: \";; HEADER: <TIMESTAMP>\"
> +
> +Where <TIMESTAMP> is a valid ISO-8601 (RFC 3339) date.  If there
> +is such a line but <TIMESTAMP> is invalid, show a warning and
> +return nil.  If there is no valid header, return nil."
> +  (save-excursion
> +    (goto-char (point-min))
> +    (when (re-search-forward (concat "^;; " header ": *\\(.+?\\) *$") nil t)
> +      (condition-case-unless-debug nil
> +          (encode-time (iso8601-parse (match-string 1)))
> +        (lwarn '(package timestamp)
> +               (list (format "Malformed timestamp for archive `%s': `%s'"
> +                             name (match-string 1))))))))

Hmm... I think you forgot the `error` in this
`condition-case-unless-debug` (i.e. the way you wrote it, it will catch
all `lwarn` errors).

> +(defun package--parse-valid-until-from-buffer (name)
> +  "Find and return \"Valid-Until\" header for archive NAME."
> +  (package--parse-header-from-buffer "Valid-Until" name))

It would be easier for the ELPA archives is to use a "validity duration"
header, since it could then be constant.

Other that that, LGTM,

[ BTW, to mitigate against replay attacks in the absence of timestamps,
  we could compare the last `archive-content` with the new one and make
  sure that none of the packages's version got smaller.  ]


        Stefan