Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 114820

Summary: PerlQt appears to have RUNPATH issues
Product: Gentoo Security Reporter: Jason Wever (RETIRED) <weeve>
Component: Runpath IssuesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: alan, alanm, caleb, gentoo-bugs, gentoo, kazemzad, perl
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3? [ebuild]
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 81745    
Attachments: Compile error of PerlQT-3.006
Almost there (fixes this bug, brings a new one)
Updated ebuild

Description Jason Wever (RETIRED) gentoo-dev 2005-12-07 18:18:34 UTC
dev-perl/PerlQt appears to have insecure RUNPATH issues.  On emerging version
3.009_beta1, the following error appears on ~sparc;

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/PerlQt-3.009_beta1/image/usr/lib:/usr/qt/3/lib
usr/lib/perl5/site_perl/5.8.7/sparc-linux/auto/Qt/Qt.so
/var/tmp/portage/PerlQt-3.009_beta1/image/usr/lib:/usr/lib usr/bin/puic

This also happens with version 3.008-r1.  I've double checked neither 
ExtUtils-MakeMaker package is installed, so that should not be influencing this.
Comment 1 Martin Wegner 2005-12-09 16:00:21 UTC
Having the same here with 3.008-r1:

man:
gzipping man page: Qt.3pm
prepallstrip:
strip: i686-pc-linux-gnu-strip --strip-unneeded
   usr/lib/libsmokeqt.so.1.2.1
   usr/lib/perl5/site_perl/5.8.7/i686-linux/auto/Qt/Qt.so
   usr/bin/puic
making executable: /usr/lib/libsmokeqt.so.1.2.1

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/PerlQt-3.008-r1/image/usr/lib:/usr/qt/3/lib
usr/lib/perl5/site_perl/5.8.7/i686-linux/auto/Qt/Qt.so


!!! ERROR: dev-perl/PerlQt-3.008-r1 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
!!! Insecure binaries detected
!!! If you need support, post the topmost build error, NOT this status message.
Comment 2 Martin Wegner 2005-12-09 16:15:56 UTC
Created attachment 74406 [details]
Compile error of PerlQT-3.006

3.008 fails with same error as above, 3.006 fails with attached error, so there
are no working versions left (including bug #100215)
Comment 3 Michael Cummings (RETIRED) gentoo-dev 2005-12-14 02:56:39 UTC
fyi, i am working on this, i've gotten one of the two fixed (Qt.so), still
working on getting the binary file fixed as well
Comment 4 Michael Cummings (RETIRED) gentoo-dev 2005-12-14 06:04:32 UTC
Created attachment 74709 [details]
Almost there (fixes this bug, brings a new one)

This is a test ebuild - works good on the first emerge
Comment 5 Michael Cummings (RETIRED) gentoo-dev 2005-12-14 06:05:52 UTC
(In reply to comment #4)
> This is a test ebuild - works good on the first emerge

To clarify - the problem I've run into is this ebuild will work fine to install
PerlQt if its a fresh install, no problem - but if its a reinstall of the same
version, the configure bit hangs checking for smokeqt in what looks to be an
infinite loop. I'm thinking my hacks to make it compliant on one front are
confusing it on a second install. Open to feedback and suggestions, my brain hurts.
Comment 6 Michael Cummings (RETIRED) gentoo-dev 2005-12-15 02:05:01 UTC
I realized on my way into work this morning that this ebuild doesn't have
anything akin to support for amd64/etc. (/usr/lib vs /usr/lib64, etc.) - should
be a quick change, but didn't want anyone going to town with this as is.
Comment 7 Michael Cummings (RETIRED) gentoo-dev 2005-12-16 14:20:20 UTC
hold off on this patch - there is now a flurry of perl 5.8.7 based bugs for runpath issues, its starting to look like something is amiss in 5.8.7 (soon as i can confirm a test case at home)
Comment 8 Michael Cummings (RETIRED) gentoo-dev 2005-12-19 06:50:51 UTC
Created attachment 75096 [details]
Updated ebuild

Not only a version bump (seems upstream bumped 5 days after the previous beta), but also a working version. I'm still not thrilled with some of the steps I've taken for this ebuild, but it is functional, avoids all aforementioned errors, and is being presented for comment.
Comment 9 Michael Cummings (RETIRED) gentoo-dev 2005-12-19 06:51:52 UTC
(In reply to comment #8)
> Created an attachment (id=75096) 

Sorry, forgot this wouldn't get passed through - this file should be called PerlQt-3.009_beta2.ebuild


Comment 10 Thierry Carrez (RETIRED) gentoo-dev 2005-12-23 02:42:05 UTC
Jason: does the provided ebuild fix it for you ?
Comment 11 Jason Wever (RETIRED) gentoo-dev 2005-12-24 07:38:08 UTC
Yes, the ebuild works for me.
Comment 12 Thierry Carrez (RETIRED) gentoo-dev 2005-12-27 01:04:50 UTC
OK, then I guess Michael can go ahead...
Comment 13 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-01-02 13:13:58 UTC
Micheal any news on this one?
Comment 14 Michael Cummings (RETIRED) gentoo-dev 2006-01-16 06:03:20 UTC
ebuild posted, sorry 'bout that
Comment 15 Caleb Tennis (RETIRED) gentoo-dev 2006-01-26 05:27:32 UTC
Looks to be fixed now.
Comment 16 Jakub Moc (RETIRED) gentoo-dev 2006-02-01 01:00:58 UTC
*** Bug 121117 has been marked as a duplicate of this bug. ***
Comment 17 Alan Jackson 2006-02-05 14:43:07 UTC
Beta works on AMD64 X2 system
Comment 18 Jakub Moc (RETIRED) gentoo-dev 2006-02-26 23:35:46 UTC
*** Bug 124224 has been marked as a duplicate of this bug. ***
Comment 19 Jakub Moc (RETIRED) gentoo-dev 2006-03-31 23:48:09 UTC
*** Bug 128331 has been marked as a duplicate of this bug. ***
Comment 20 trefoil 2006-04-01 10:43:26 UTC
I'm curious why this bug is marked resolved fixed when I just ran into this issue last night with the current stable version, 3.008-r1. Shouldn't a stabling bug be filed? The above bug is mine.
Comment 21 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-04-03 05:49:09 UTC
(In reply to comment #20)
> I'm curious why this bug is marked resolved fixed when I just ran into this
> issue last night with the current stable version, 3.008-r1. Shouldn't a
> stabling bug be filed? The above bug is mine.
> 

That's true, only x86 is stable for PerlQt-3.009_beta2. You might want to try it.

I suppose the maintainers are working on marking stable this version on the other archs.
Comment 22 Jakub Moc (RETIRED) gentoo-dev 2007-02-07 08:24:13 UTC
*** Bug 165724 has been marked as a duplicate of this bug. ***