Do not download updateinfo and comps metadata by default #630
Conversation
libdnf/conf/config_main.cpp
Outdated
| @@ -187,8 +187,7 @@ class ConfigMain::Impl { | |||
| OptionBool debug_solver{false}; | |||
| OptionStringList installonlypkgs{INSTALLONLYPKGS}; | |||
| OptionStringList group_package_types{GROUP_PACKAGE_TYPES}; | |||
| OptionStringSet optional_metadata_types{ | |||
| OptionStringSet::ValueType{libdnf::METADATA_TYPE_COMPS, libdnf::METADATA_TYPE_UPDATEINFO}}; | |||
| OptionStringSet optional_metadata_types{OptionStringSet::ValueType{}}; | |||
There was a problem hiding this comment.
We can modify in dnf5 default but we should not modify library defaults. This default is insecure. I would rather investigate the cause then disabling loading.
There was a problem hiding this comment.
I added the blocker only because of the change of default type for download.
j-mracek
added
the
blocked
|
This patch is not fixing the issue but hides it. It looks like that the issue is in processing updateinfo metadata, because I was unable to reproduce the issue with Update: |
kontura
force-pushed
the
optional_metadata
branch
from
531f181
to
976dfe2
Compare
It fixes the condition and extracts it into a separate function.
'@' also denotes a module but modules are handled only by module commands. Also I am not sure there is a way how to differentiate a group from a module by the spec. This method is also used from commands that don't use comps in any way such as repoquery so perhaps it would be better to have a separate check only in relevant commands. On the other hand I like the unified handling.
|
LGTM |
|
@kontura May I ask you for rebase? |
kontura
force-pushed
the
optional_metadata
branch
from
976dfe2
to
7370205
Compare
Sure, rebased. |
kontura
added
ready for review
and removed
blocked
Updateinfo and comps metadata were always downloaded and loaded by default. This is not necessary because each command configures the
optional_metadata_typesto download/load only what it requires.Also there was a bug in detection whether updateinfo metadata are needed.
For: https://bugzilla.redhat.com/show_bug.cgi?id=2214520
In my testing when loading updateinfo metadata memory requirements spike at ~623 MiB but without them its only ~132 MiB (on F38 with clean cache). I will further investigate why the updateinfo metadata use so much during libsolv loading, it seems unexpected to me given their size.