Bug 907946 – media-gfx/gmic-3.2.4[qt5]: scanelf: rpath_security_checks(): Security problem with relative DT_RUNPATH '.'

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Attila Tóth 2023-06-06 08:43:18 UTC]

While compiling media-gfx-3.2.4:
scanelf: rpath_security_checks(): Security problem with relative DT_RUNPATH '.' in /var/tmp/portage/media-gfx/gmic-3.2.4/image/usr/bin/gmic_qt
scanelf: rpath_security_checks(): Security problem with relative DT_RUNPATH '.' in /var/tmp/portage/media-gfx/gmic-3.2.4/image/usr/lib64/gimp/2.0/plug-ins/gmic_gimp_qt

Reproducible: Always

[Comment 1 Agostino Sarubbo 2023-06-06 12:24:40 UTC]

I don't get this warning, so I suppose you should add more info about.


Anyway, for the maintainer, while trying to reproduce this bug I noticed that gmic.cpp is compiled twice (for nothing apparently)

[Comment 2 Mike Gilbert 2023-06-06 21:33:25 UTC]

Please provide emerge --info and attach a full build log. Then change the status to UNCONFIRMED.

[Comment 3 Attila Tóth 2023-06-07 07:18:50 UTC]

Created attachment 863443 [details]
build.log.bz2

Requested build.log

[Comment 4 Attila Tóth 2023-06-07 07:21:01 UTC]

Created attachment 863444 [details]
emerge.info.bz2

emerge --info requested

[Comment 5 Marek Szuba 2023-06-10 10:01:16 UTC]

Turns out upstream sneaked '-Wl,-rpath,.' into the Qt project as well. Will be fixed in the 3.2.5 ebuild.

Ago: yes, that can happen when a package simultaneously uses several different build systems... I do not think I will fix this though, on the one hand I've got zero experience with coding Qt projects and on the other I have been steadily getting fed up with G'MIC upstream since they abandoned CMake in favour of a massive hand-crafted Makefile (without, I might add, actually fixing at least some of the problems they said made them make the change).

[Comment 6 Larry the Git Cow 2023-06-10 10:35:31 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=35708a59267472d95a46cf1057fc0c2b7dbab1a8

commit 35708a59267472d95a46cf1057fc0c2b7dbab1a8
Author:     Marek Szuba <[e-mail]>
AuthorDate: 2023-06-10 10:24:35 +0000
Commit:     Marek Szuba <[e-mail]>
CommitDate: 2023-06-10 10:35:09 +0000

    media-gfx/gmic: add 3.2.5, drop 3.2.4
    
    Closes: https://bugs.gentoo.org/907946
    Signed-off-by: Marek Szuba <[e-mail]>

 media-gfx/gmic/Manifest                            |  2 +-
 .../gmic/files/gmic-3.2.5-relative_rpath.patch     | 22 ++++++++++++++++++++++
 .../gmic/{gmic-3.2.4.ebuild => gmic-3.2.5.ebuild}  |  2 +-
 3 files changed, 24 insertions(+), 2 deletions(-)

[Comment 7 Attila Tóth 2023-06-10 15:05:24 UTC]

(In reply to Marek Szuba from comment #5)
> Turns out upstream sneaked '-Wl,-rpath,.' into the Qt project as well. Will
> be fixed in the 3.2.5 ebuild.
> 
> Ago: yes, that can happen when a package simultaneously uses several
> different build systems... I do not think I will fix this though, on the one
> hand I've got zero experience with coding Qt projects and on the other I
> have been steadily getting fed up with G'MIC upstream since they abandoned
> CMake in favour of a massive hand-crafted Makefile (without, I might add,
> actually fixing at least some of the problems they said made them make the
> change).

Thank you for looking into this!