Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 690684 - repoman: Add check for obsolete GitHub/GitLab URIs
Summary: repoman: Add check for obsolete GitHub/GitLab URIs
Status: RESOLVED WONTFIX
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Repoman (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-25 07:30 UTC by Michał Górny
Modified: 2022-07-12 03:18 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2019-07-25 07:30:44 UTC
A whole lot of ebuilds is still using the old /tarball URIs that result in unpredictable filenames and checksum collisions.  Please add a check for those URIs, and possibly suggest replacement with modern archive URIs.

Basically it would need to match:

  https://github.com/${USER}/${REPO}/tarball/${REF}
  https://github.com/${USER}/${REPO}/zipball/${REF}

and replace it with:

  https://github.com/${USER}/${REPO}/archive/${REF}.tar.gz
  https://github.com/${USER}/${REPO}/archive/${REF}.zip

(though there's no technical reason to ever use zip, I think)

Similarly for GitLab it could match:

  https://gitlab.com/${USER}/${REPO}/repository/archive.tar?ref=${REF}
  https://gitlab.com/${USER}/${REPO}/repository/archive.tar.gz?ref=${REF}
  https://gitlab.com/${USER}/${REPO}/repository/archive.tar.bz2?ref=${REF}
  https://gitlab.com/${USER}/${REPO}/repository/archive.zip?ref=${REF}

and replace it with:

  https://gitlab.com/${USER}/${REPO}/-/archive/${REF}.tar.gz

etc. (all four formats supported)


My implementation for pkgcheck: https://github.com/pkgcore/pkgcheck/pull/92/files#diff-9c6c1df39c06ed3f22be6d9216285626R330
Comment 1 Arfrever Frehtes Taifersar Arahesis 2019-07-27 01:32:49 UTC
(In reply to Michał Górny from comment #0)

> Similarly for GitLab it could match:
> 
>   https://gitlab.com/${USER}/${REPO}/repository/archive.tar?ref=${REF}
>   https://gitlab.com/${USER}/${REPO}/repository/archive.tar.gz?ref=${REF}
>   https://gitlab.com/${USER}/${REPO}/repository/archive.tar.bz2?ref=${REF}
>   https://gitlab.com/${USER}/${REPO}/repository/archive.zip?ref=${REF}
> 
> and replace it with:
> 
>   https://gitlab.com/${USER}/${REPO}/-/archive/${REF}.tar.gz
> 
> etc. (all four formats supported

Either of them would require "->" redirection in SRC_URI.
GitLab supports specifying target filename with ".../-/archive/${REF}/${target_filename}" syntax.

So instead of using:
  https://gitlab.com/${USER}/${REPO}/-/archive/${REF}.tar.gz -> ${P}.tar.gz

Please make suggestion to use:
  https://gitlab.com/${USER}/${REPO}/-/archive/${REF}/${P}.tar.gz


For example app-i18n/man-pages-fr-3.70-r1 contains:
  https://gitlab.com/perkamon/man-pages/-/archive/${PV}/man-pages-${PV}.tar.gz -> perkamon-man-pages-${PV}.tar.gz

Which can be simplified to:
  https://gitlab.com/perkamon/man-pages/-/archive/${PV}/perkamon-man-pages-${PV}.tar.gz
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2019-07-27 05:27:17 UTC
Yes, I'm sorry, my suggestion was incorrect.

(In reply to Michał Górny from comment #0)
> Similarly for GitLab it could match:
> 
>   https://gitlab.com/${USER}/${REPO}/repository/archive.tar?ref=${REF}
>   https://gitlab.com/${USER}/${REPO}/repository/archive.tar.gz?ref=${REF}
>   https://gitlab.com/${USER}/${REPO}/repository/archive.tar.bz2?ref=${REF}
>   https://gitlab.com/${USER}/${REPO}/repository/archive.zip?ref=${REF}
> 
> and replace it with:
> 
>   https://gitlab.com/${USER}/${REPO}/-/archive/${REF}.tar.gz

https://gitlab.com/${USER}/${REPO}/-/archive/${REF}/${REPO}-${REF}.tar.gz

is the only correct form.  While GL permits anything after the slash, any other value will not give the correct tarball (i.e. the one without full hash embedded).  Don't ask me...
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 03:18:15 UTC
repoman support has been removed per bug 835013.

Please file a new bug (or, I suppose, reopen this one) if you feel this check is still applicable to pkgcheck and doesn't already exist.