Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Binary hacking FTW.

The semi-official Debian server, alioth.debian.org, where a lot of random developer stuff is hosted, is stuck on Debian wheezy for various reasons. Most users, including myself (a Debian Developer) don't have root access to upgrade the server nor install new software.

The version of libapt-inst is too old to support Debian packages with control.tar.xz members (only control.tar.gz members). So we can't upload newer Debian packages to various custom APT repos that we host on that server.

I worked around this by looking at the libapt-inst source code, figuring out how to make it support control.tar.xz instead of control.tar.gz, and binary-patched libapt-inst.so to have this effect instead. It's actually fairly simple

1. there is a check for control.tar.gz, the failure branch prints an error and then returns. I overwrite this with NOP so it goes into the "success" branch.

2. then later it extracts the control.tar.gz member and pipes it through gzip. Luckily, nowhere else in the program uses the exact string "control.tar.gz" or "gzip" so I simply patch that string "control.tar.gz" -> "control.tar.xz" in the binary and also change "gzip" -> "xz\0\0".

(Actually given the change in (2), (1) is not necessary. But without it you get a bunch of spurious error messages.)

Applying this patch makes the resulting .so lose the ability of working with old control.tar.gz members (which is still needed of course). So my workaround does this:

LD_PRELOAD=libapt-inst.so.patched apt-ftparchive [..] && apt-ftparchive [..]

i.e. runs it once with the hack to pick up the new-style debs, and once again without the hack to pick up the old-style debs.

My motto is, "dirty solutions for dirty problems". :D :D :D



> The semi-official Debian server, alioth.debian.org, where a lot of random developer stuff is hosted, is stuck on Debian wheezy for various reasons

Jeez. How is security maintained? That actually scares me a bit.


Wheezy is supported until the end of May 2018, so it still gets security patches.


dirty solutions for dirty problems :):)




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: