5.1 Preconditions

2 min read

An install begins with a package file already fetched, the repository it came from with its trust state, the current database state, and the plan that called for the install.

The following hold before the install proceeds:

  1. The package's hash matches what the repository index recorded.
  2. The package's signature, if present, verifies against the trust set scoped to its originating repository.
  3. The package is not already installed at the same version and architecture in this root.
  4. The package's architecture is the system's primary architecture or noarch.
  5. The package's dependencies are satisfied by the installed set, by the plan in flight, or by both together.
  6. No installed package conflicts with it.

A precondition failure aborts the install, and the transaction containing it is rolled back.

5.1.1 Verification before extraction #

For a transaction containing several installs or upgrades, every package's signature and index-hash verification completes before any package's payload is extracted.

The guarantee spans every root the operation touches. A cross-root transaction fetches and verifies every participating root's packages before preparing any of them, because a package extracted into one root is as present on the filesystem as one extracted into another — the attack above works just as well with A and B in different roots.

Edit this page