Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 292394

Summary: dev-util/pkgcheck: having the value of $P in SRC_URI without using $P for it should be fatal
Product: Gentoo Linux Reporter: Petteri Räty (RETIRED) <betelgeuse>
Component: Current packagesAssignee: Michał Górny <mgorny>
Status: RESOLVED WONTFIX    
Severity: normal CC: alex_y_xu, jbartosik
Priority: High Keywords: Inclusion, PATCH
Version: unspecified   
Hardware: All   
OS: Linux   
See Also: https://bugs.gentoo.org/show_bug.cgi?id=562812
Whiteboard:
Package list:
Runtime testing required: ---
Attachments: Patch to add check for package name and version in SRC_URI.
Patch to add check for package name and version in SRC_URI and a bit of tests.
Patch to remove tests after aplying previous patch.
Checks each line if it contains SRC_URI it checks if the line contains something similar to (expanded) $P.
And some tests to check it does, what it should.
And some tests to check it does, what it should.
Now it uses one regexp and handles comments properly.
And tests for previuous patch.
New improved check ( case-sensitive).
Tests for check.
Right this time I hope...
;(

Description Petteri Räty (RETIRED) gentoo-dev 2009-11-08 15:52:10 UTC
In ebuild foomatic-1:
SRC_URI="http://foobar/foomatic-1.tar.gz"
repoman should fail if you match the expanded value of $P
Comment 1 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-17 12:29:19 UTC
Created attachment 228129 [details, diff]
Patch to add check for package name and version in SRC_URI.
Comment 2 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-17 12:30:15 UTC
Created attachment 228131 [details, diff]
Patch to add check for package name and version in SRC_URI and a bit of tests.
Comment 3 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-17 12:30:56 UTC
Created attachment 228133 [details, diff]
Patch to remove tests after aplying previous patch.

There are no tests for repoman currently.
Comment 4 SpanKY gentoo-dev 2010-04-19 23:30:37 UTC
umm, why exactly is $P in SRC_URI invalid ?  this summary makes no sense -- $P in SRC_URI is perfectly valid, and plenty of packages use it.

$ cd /usr/portage
$ grep -R SRC_URI.*'${P}' .
...
sys-apps/openrc/openrc-0.6.1-r1.ebuild: SRC_URI="http://roy.marples.name/downloads/${PN}/${P}.tar.bz2"
...
sys-apps/x86info/x86info-1.25.ebuild:SRC_URI="http://www.codemonkey.org.uk/projects/x86info/${P}.tgz"
...
Comment 5 Sebastian Pipping gentoo-dev 2010-04-20 00:55:32 UTC
(In reply to comment #4)
> umm, why exactly is $P in SRC_URI invalid ?  this summary makes no sense -- $P
> in SRC_URI is perfectly valid, and plenty of packages use it.
> 
> $ cd /usr/portage
> $ grep -R SRC_URI.*'${P}' .

betelgeuse is referring to the value of ${P} not the string "${P}".
latter is good (agreeing with you), latter is bad (agreeing with betelgeuse).
Comment 6 Sebastian Pipping gentoo-dev 2010-04-20 00:57:51 UTC
one more try (correcting myself):

betelgeuse is referring to the value of ${P} not the string '${P}'.
latter is good (agreeing with you), former is bad (agreeing with betelgeuse).
Comment 7 SpanKY gentoo-dev 2010-04-20 02:34:11 UTC
oh, so with his original example, an ebuild that literally has:
  SRC_URI="http://foobar/foomatic-1.tar.gz"

should get a warning to use something like:
  SRC_URI="http://foobar/${P}.tar.gz"

thanks for the clarification
Comment 8 Sebastian Pipping gentoo-dev 2010-04-20 13:26:30 UTC
Joachim, very cool to have you working on this.
To really get it in to repoman I would recommend meeting zmedico on Freenode IRC.
Comment 9 Zac Medico gentoo-dev 2010-04-24 04:50:13 UTC
(In reply to comment #2)
> Created an attachment (id=228131) [details]
> Patch to add check for package name and version in SRC_URI and a bit of tests.

This only checks pkg.metadata["SRC_URI"] which has already been expanded by bash. We need it to use the check(line) method to identify the SRC_URI definition and verify that it doesn't contain $P.
Comment 10 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-24 20:00:42 UTC
Created attachment 229023 [details, diff]
Checks each line if it contains SRC_URI it checks if the line contains something similar to (expanded) $P.
Comment 11 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-24 20:01:36 UTC
Created attachment 229025 [details]
And some tests to check it does, what it should.
Comment 12 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-24 20:01:47 UTC
Created attachment 229027 [details, diff]
And some tests to check it does, what it should.
Comment 13 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-24 20:03:17 UTC
Ouch, didn't stop badly typed attachment in time :/
Comment 14 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-25 00:44:38 UTC
Two things are wrong with this patch ( it's using two regexps but it could one and it doesn't check lines with SRC_URI and comment), so don't bother reading it. I'll fix it on monday.
Comment 15 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-26 09:57:15 UTC
Created attachment 229205 [details, diff]
Now it uses one regexp and handles comments properly.
Comment 16 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-26 09:59:08 UTC
Created attachment 229207 [details, diff]
And tests for previuous patch.
Comment 17 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-27 18:21:48 UTC
Created attachment 229427 [details, diff]
New improved check ( case-sensitive).
Comment 18 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-27 18:22:15 UTC
Created attachment 229429 [details, diff]
Tests for check.
Comment 19 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-27 18:24:27 UTC
Created attachment 229431 [details, diff]
Right this time I hope...
Comment 20 Joachim Bartosik (RETIRED) gentoo-dev 2010-04-27 18:25:14 UTC
Created attachment 229433 [details, diff]
;(
Comment 21 Alex Xu (Hello71) 2015-07-02 16:38:14 UTC
wouldn't it be easier/more accurate to just check for '$' character in SRC_URI and warn if it is not found? (assuming people are aware of all variables if they know one)
Comment 22 Brian Dolbec (RETIRED) gentoo-dev 2017-03-16 00:36:36 UTC
Zac, I take it this still needs to be ported to the new repoman system?
Comment 23 Zac Medico gentoo-dev 2020-09-11 21:58:04 UTC
(In reply to Brian Dolbec from comment #22)
> Zac, I take it this still needs to be ported to the new repoman system?

Yeah, we haven't merged a patch for this yet.
Comment 24 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 03:18:37 UTC
repoman support has been removed per bug 835013.

Please file a new bug (or, I suppose, reopen this one) if you feel this check is still applicable to pkgcheck and doesn't already exist.
Comment 25 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 03:43:17 UTC
I don't recall if pkgcheck handles this, I think no?
Comment 26 Mike Gilbert gentoo-dev 2022-07-12 03:52:45 UTC
I disagree with the premise of this bug: writing the full name of the file in SRC_URI is perfectly valid and should not be "fatal".
Comment 27 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-07-12 07:21:45 UTC
I can see use case for this as well — say, fetching patch via SRC_URI.  If the patch is unlikely to change in the next version, you don't want ${P} there.