portsnap: consistently add .gz extension on gunzip invocation

[emaste]

Summary

gunzip attempts to open the file name as given, and if that does not exist attempts to open the file name with a .gz extension appended. Prior to this change, in all but one case portsnap appended the .gz extension when invoking gunzip, but did not in fetch_snapshot_verify. Thus it was possible that if two files ${F} and ${F}.gz both existed, ${F} will be used by fetch_snapshot_verify and ${F}.gz everywhere else. By appending the extension consistently we ensure that all cases process the same file.

Issue reported in the "non-cryptanalytic attacks against freebsd update components" anonymous gist.

[delphij]

usr.sbin/portsnap/portsnap/portsnap.sh

654

We already have a similar change staged already, but slightly differently. (gunzip -c < snap/${F}.gz). This approach is better because it does not rely on gunzip's capability of detecting files.