Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 654960 - unpacker.eclass: unpacker_src_uri_depends subject to accidental globbing
Summary: unpacker.eclass: unpacker_src_uri_depends subject to accidental globbing
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Eclasses (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-05-05 11:41 UTC by Michał Górny
Modified: 2018-06-26 07:44 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-05 11:41:15 UTC
Example (due to EAPI 6 failglob):

/home/mgorny/pypy-gentoo/eclass/unpacker.eclass: line 436: no match: l10n_cs?

Please fix the eclass not to allow globs when processing variables that can contain '*', '?' etc.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-05 11:42:20 UTC
Actually, it's bigger issue than I thought -- since failglob causes the assignment to fail, the eclass doesn't add dependencies in those ebuilds.
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-05-05 11:50:05 UTC
Affected packages:

games-rpg/draci-historie
games-rpg/dreamweb
games-rpg/soltys

Of course, another question is why developers keep ignoring explicit errors, and why do they need to use this convoluted function instead of adding DEPEND on unzip.  Or why do we keep this awful function in the first place if it's used by total of 10 ebuilds.
Comment 3 josef.95 2018-05-06 10:51:45 UTC
Hm yes, currently I have here:

 * Updating metadata cache for gentoo ...
/usr/portage/eclass/unpacker.eclass: line 436: no match: l10n_cs?
/usr/portage/eclass/unpacker.eclass: line 436: no match: doc?
/usr/portage/eclass/unpacker.eclass: line 436: no match: l10n_en?

cat /usr/portage/metadata/timestamp.chk 
Sun, 06 May 2018 08:38:03 +0000
Comment 4 Larry the Git Cow gentoo-dev 2018-06-26 03:30:10 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=886cc632a0a5a0c4df3b7793b497ddbe8925e357

commit 886cc632a0a5a0c4df3b7793b497ddbe8925e357
Author:     Mike Frysinger <vapier@gentoo.org>
AuthorDate: 2018-06-26 03:28:02 +0000
Commit:     Mike Frysinger <vapier@gentoo.org>
CommitDate: 2018-06-26 03:29:37 +0000

    unpacker.eclass: disable path expansion while parsing SRC_URI #654960
    
    Closes: https://bugs.gentoo.org/654960

 eclass/unpacker.eclass | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
Comment 5 SpanKY gentoo-dev 2018-06-26 03:31:36 UTC
(In reply to Michał Górny from comment #2)

you should keep your pointless editorializing to yourself.  they contribute nothing to the project.
Comment 6 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2018-06-26 06:16:56 UTC
(In reply to Larry the Git Cow from comment #4)
> The bug has been closed via the following commit(s):
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=886cc632a0a5a0c4df3b7793b497ddbe8925e357
> 
> commit 886cc632a0a5a0c4df3b7793b497ddbe8925e357
> Author:     Mike Frysinger <vapier@gentoo.org>
> AuthorDate: 2018-06-26 03:28:02 +0000
> Commit:     Mike Frysinger <vapier@gentoo.org>
> CommitDate: 2018-06-26 03:29:37 +0000
> 
>     unpacker.eclass: disable path expansion while parsing SRC_URI #654960
>     
>     Closes: https://bugs.gentoo.org/654960
> 
>  eclass/unpacker.eclass | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)

I would like to remind you that eclass updates require review on gentoo-dev mailing list.  I would also like to remind you that policies apply to you as well.

(In reply to SpanKY from comment #5)
> (In reply to Michał Górny from comment #2)
> 
> you should keep your pointless editorializing to yourself.  they contribute
> nothing to the project.

This comment is entirely unnecessary and contributes nothing to Gentoo.
Comment 7 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2018-06-26 06:44:54 UTC
nothing to do for comrel
Comment 8 SpanKY gentoo-dev 2018-06-26 07:44:24 UTC
(In reply to Michał Górny from comment #6)

-ECITATIONMISSING

> (In reply to SpanKY from comment #5)
>> (In reply to Michał Górny from comment #2)
>
> This comment is entirely unnecessary and contributes nothing to Gentoo.

i assume this means you agree and you'll try better.