Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 612896 - games-action/descent2-data-1.0 accesses DISTDIR in pkg_setup, bypasses Manifest verification
Summary: games-action/descent2-data-1.0 accesses DISTDIR in pkg_setup, bypasses Manife...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal QA (vote)
Assignee: Gentoo Games
URL:
Whiteboard:
Keywords: InVCS
Depends on:
Blocks: 369397 612966
  Show dependency tree
 
Reported: 2017-03-17 12:13 UTC by Ulrich Müller
Modified: 2020-03-29 18:22 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ulrich Müller gentoo-dev 2017-03-17 12:13:09 UTC
The ebuild tries to access ${DISTDIR} in pkg_setup where the variable is not valid.

Also, while SRC_URI is empty, it accesses a file in ${DISTDIR} in src_unpack, bypassing Manifest checksum verification.

PMS reference: https://projects.gentoo.org/pms/6/pms.html#x1-11800011.1

Further issues:
- Still uses games.eclass
- HOMEPAGE returns 404
- RESTRICT="bindist" is missing (also "mirror" once the file is properly
  added to SRC_URI)
Comment 1 James Le Cuirot gentoo-dev 2017-03-17 12:27:33 UTC
Funny, this hasn't been touched in years but it just so happens I've been working on it this week.

I noticed the DISTDIR thing and figured that was bad. I don't think it would even work as DISTDIR is a filtered view of the files?

I don't think RESTRICT="mirror" will apply as there won't be a URL for the data file. There will be an additional patch file in SRC_URI and that can be mirrored.

Is RESTRICT="bindist" actually necessary? I'm not sure if the rule applies to commercial data files.

I've also fixed the HOMEPAGE and removed games.eclass. I'm just making some final tweaks before I get it all pushed.
Comment 2 Ulrich Müller gentoo-dev 2017-03-17 12:54:11 UTC
(In reply to James Le Cuirot from comment #1)
> I noticed the DISTDIR thing and figured that was bad. I don't think it would
> even work as DISTDIR is a filtered view of the files?

Right, modern portage versions set up a shadow dir containing only the files in ${A}. (Not sure if that exists in pkg_* though, but PMS says that DISTDIR is not valid there anyway.)

> Is RESTRICT="bindist" actually necessary? I'm not sure if the rule applies
> to commercial data files.

Definitely. The license explicitly forbids distribution, and that will apply to binpkgs too.
Comment 3 James Le Cuirot gentoo-dev 2017-04-27 21:45:23 UTC
Fixed in 1.2. Needs stabilising.
Comment 4 Ulrich Müller gentoo-dev 2020-03-29 18:22:55 UTC
(In reply to James Le Cuirot from comment #3)
> Fixed in 1.2. Needs stabilising.

No stable games-* currently, and 1.0 is long gone. Closing.