Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 754921 - =dev-ruby/execjs-2.7.0: conditionally depend on dev-ruby/duktape-rb
Summary: =dev-ruby/execjs-2.7.0: conditionally depend on dev-ruby/duktape-rb
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Ruby Team
URL:
Whiteboard:
Keywords:
Depends on: 754918
Blocks: CVE-2020-8201, CVE-2020-8251
  Show dependency tree
 
Reported: 2020-11-16 13:46 UTC by Marek Szuba
Modified: 2020-11-21 20:26 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marek Szuba archtester gentoo-dev 2020-11-16 13:46:57 UTC
At the moment the only JavaScript runtime our execjs ebuilds depend on is net-libs/nodejs. Node upstream does not officially support 32-bit PPC, none of the versions currently in Gentoo even build on that arch, and the lone ebuild still keyworded for it (solely for the purpose of not breaking the execjs dependency tree) is due for security cleaning.

According to the execjs home page, duktape-rb is not only supported but actually preferred (as per both the README and the evaluation order in the code) to Node.JS. It also appears to work fine on PPC32.

Note that should you choose to revbump execjs while making this change (probably not necessary given the aforementioned build failures in node), the revbump should go straight to stable on ppc.
Comment 1 Hans de Graaff gentoo-dev Security 2020-11-21 08:52:54 UTC
I've opted to add a new revision for this to also update the EAPI.

I have also listed duktape-rb as the first option. Since it is embedded there is a huge difference in running the test suite: 0.5s for duktape vs 9.5s for nodejs.

I have some compatibility concerns for ES6/7 feature differences in duktape vs node in real-world scenarios but given the speed-up bonus I'd say that is a good trade-off. Note that going straight to stable is not possible since duktape-rb is not stable.
Comment 2 Larry the Git Cow gentoo-dev 2020-11-21 08:53:05 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c4ca787fbe41ec1e4489704931e1912f45194a68

commit c4ca787fbe41ec1e4489704931e1912f45194a68
Author:     Hans de Graaff <graaff@gentoo.org>
AuthorDate: 2020-11-21 08:52:49 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2020-11-21 08:52:49 +0000

    dev-ruby/execjs: EAPI 7, add duktape-rb
    
    Closes: https://bugs.gentoo.org/754921
    Package-Manager: Portage-3.0.9, Repoman-3.0.2
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 dev-ruby/execjs/execjs-2.7.0-r1.ebuild | 35 ++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
Comment 3 Hans de Graaff gentoo-dev Security 2020-11-21 09:09:16 UTC
Ah, duktape-rb is stable for ppc only. I have added a ppc stable keyword to the new execjs-2.7.0-r1, but I'd like to wait some time with other arches. I'm already seeing compatibility issues with this for projects at work.
Comment 4 Larry the Git Cow gentoo-dev 2020-11-21 20:26:39 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=930e246410b9f585b6d6d54b57e9fe3fbbe5955d

commit 930e246410b9f585b6d6d54b57e9fe3fbbe5955d
Author:     Marek Szuba <marecki@gentoo.org>
AuthorDate: 2020-11-21 20:21:58 +0000
Commit:     Marek Szuba <marecki@gentoo.org>
CommitDate: 2020-11-21 20:26:30 +0000

    dev-ruby/execjs-2.7.0: drop ppc keyword
    
    The last net-libs/nodejs ebuild keyworded for ppc has just been
    removed due to security vulnerabilties, and it didn't actually compile
    on that arch anyway.
    
    Bug: https://bugs.gentoo.org/754921
    Signed-off-by: Marek Szuba <marecki@gentoo.org>

 dev-ruby/execjs/execjs-2.7.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)