Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 287706

Summary: dev-util/pkgcheck: detect DISTDIR= munging
Product: Gentoo Hosted Projects Reporter: SpanKY <vapier>
Component: PkgCoreAssignee: PkgCore project <pkgcore>
Status: UNCONFIRMED ---    
Severity: normal CC: mgorny
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description SpanKY gentoo-dev 2009-10-05 06:11:05 UTC
i just came across these gems today:
./net-dialup/fcdsl/fcdsl-0.1.ebuild:
    DISTDIR="${WORKDIR}" unpack ${PN}-suse[0-9][0-9]-[0-9].[0-9]*-[0-9]*.tar.gz

apparently the developer was unaware of the ./ syntax that unpack supports, or this code predates it.  either way, it makes no sense today and can easily be changed to:
    unpack ./${PN}-suse[0-9][0-9]-[0-9].[0-9]*-[0-9]*.tar.gz

grepping the tree for DISTDIR= usage shows a bunch of these miscreants, but i do see one usage in www-apache/passenger that might be a false positive:
    DISTDIR=${D} rake fakeroot || die

could the ruby/apache teams comment on this ?
Comment 1 Hans de Graaff gentoo-dev Security 2009-10-05 19:22:23 UTC
(In reply to comment #0)

> grepping the tree for DISTDIR= usage shows a bunch of these miscreants, but i
> do see one usage in www-apache/passenger that might be a false positive:
>     DISTDIR=${D} rake fakeroot || die

This got introduced by Benedikt in passenger-2.0.1 since the fakeroot target in the Rakefile uses the environment variable DISTDIR to determine where to install stuff. So yes, looks like false positive.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 03:18:30 UTC
repoman support has been removed per bug 835013.

Please file a new bug (or, I suppose, reopen this one) if you feel this check is still applicable to pkgcheck and doesn't already exist.
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 03:33:59 UTC
Need to check whether pkgcheck supports this.