Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 467834 - Disallow category names, package names, and slots beginning with a plus sign
Summary: Disallow category names, package names, and slots beginning with a plus sign
Status: CONFIRMED
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Core (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-29 07:00 UTC by Ulrich Müller
Modified: 2014-05-16 05:35 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ulrich Müller gentoo-dev 2013-04-29 07:00:47 UTC
The PMS says in section 3.1 about category names:

   A category name may contain any of the characters [A-Za-z0-9+_.-]. It must
   not begin with a hyphen, a dot or a plus sign.

and about package names:

   A package name may contain any of the characters [A-Za-z0-9+_-]. It must
   not begin with a hyphen or a plus sign, and must not end in a hyphen
   followed by anything matching the version syntax described in section 3.2.

Portage allows the plus sign, though. In pym/portage/versions.py:

_cat = r'[\w+][\w+.-]*'

_pkg = {
        "dots_disallowed_in_PN": r'[\w+][\w+-]*?',
        "dots_allowed_in_PN":    r'[\w+][\w+.-]*?',
}
Comment 1 Ulrich Müller gentoo-dev 2013-04-29 10:30:34 UTC
Same for SLOT, the spec forbids that it starts with a plus sign.

_slot = r'([\w+][\w+.-]*)'
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2013-04-29 14:16:47 UTC
I'm not really convinced about this. Repoman warning about invalid package name, sure. But as long as portage itself can handle such a name, I don't think we should prohibit users from using it locally.
Comment 3 Ulrich Müller gentoo-dev 2014-05-16 05:35:02 UTC
(In reply to Michał Górny from comment #2)
> I'm not really convinced about this. Repoman warning about invalid package
> name, sure. But as long as portage itself can handle such a name, I don't
> think we should prohibit users from using it locally.

Is there any real world example for the latter? Otherwise, I'd suggest that we go for the simple solution, namely fixing the regexps in versions.py.