Bug 729582

Summary:	>=net-misc/rsync-3.2.0, dev-libs/xxhash: ~riscv keyword request
Product:	Gentoo Linux	Reporter:	Lars Wendler (Polynomial-C) (RETIRED) <polynomial-c>
Component:	Keywording	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	RESOLVED FIXED
Severity:	normal	Keywords:	KEYWORDREQ
Priority:	Normal	Flags:	nattka: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:	=dev-libs/xxhash-0.7.3 ~riscv =net-misc/rsync-3.2.0-r1 ~riscv =net-misc/rsync-3.2.1 ~riscv	Runtime testing required:	---
Bug Depends on:
Bug Blocks:	728852

Description Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev

2020-06-25 09:31:12 UTC

Please add ~riscv keyword to the packages mentioned in summary or p.use.mask the corresponding USE flags for >=net-misc/rsync-3.2.0

Otherwise ~riscv has to stick to a vulnerable version of net-misc/rsync and we cannot remove the remaining vulnerable version from the tree.

Please also check for newer versions of all packages mentioned in package list and add keyword there as well.

Comment 1 NATTkA bot gentoo-dev

2020-06-25 09:32:34 UTC

Sanity check failed:

> app-arch/lz4-1.9.2
>   bdepend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     dev-util/cmake
>   bdepend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     dev-util/cmake

Comment 2 NATTkA bot gentoo-dev

2020-06-25 09:36:34 UTC

Sanity check failed:

> dev-util/cmake-3.17.3
>   bdepend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     dev-python/requests
>     dev-python/sphinx
>     x11-apps/xhost
>     x11-base/xorg-server[xvfb]
>   bdepend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     dev-python/requests
>     dev-python/sphinx
>     x11-apps/xhost
>     x11-base/xorg-server[xvfb]
>   depend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     >=dev-libs/jsoncpp-1.9.2-r2:0=
>   depend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     >=dev-libs/jsoncpp-1.9.2-r2:0=
>   rdepend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     >=dev-libs/jsoncpp-1.9.2-r2:0=
>   rdepend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     >=dev-libs/jsoncpp-1.9.2-r2:0=

Comment 3 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev

2020-06-25 09:43:32 UTC

Alright... let's stay reasonable here... lz4 requires cmake which also has no ~riscv keyword and that triggers pandora's box
So, I suggest we keep lz4 USE flag p.use.masked for ~riscv and just keyword the rest...

Comment 4 NATTkA bot gentoo-dev

2020-06-25 09:44:31 UTC

Sanity check failed:

> net-misc/rsync-3.2.0-r1
>   depend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     app-arch/lz4
>     app-arch/lz4[static-libs(+)]
>   depend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     app-arch/lz4
>     app-arch/lz4[static-libs(+)]
>   rdepend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     app-arch/lz4
>   rdepend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     app-arch/lz4
> net-misc/rsync-3.2.1
>   depend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     app-arch/lz4
>     app-arch/lz4[static-libs(+)]
>   depend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     app-arch/lz4
>     app-arch/lz4[static-libs(+)]
>   rdepend ~riscv stable profile default/linux/riscv/17.0/rv64gc (1 total)
>     app-arch/lz4
>   rdepend ~riscv dev profile default/linux/riscv/17.0/rv64gc/lp64d (1 total)
>     app-arch/lz4

Comment 5 Larry the Git Cow gentoo-dev

2020-06-25 09:46:02 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbfe6455cabf9863415193731b122851cda0c76c

commit bbfe6455cabf9863415193731b122851cda0c76c
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2020-06-25 09:44:50 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2020-06-25 09:45:57 +0000

    riscv/package.use.mask: Masked lz4 USE flag for net-misc/rsync
    
    Bug: https://bugs.gentoo.org/729582
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 profiles/arch/riscv/package.use.mask | 6 ++++++
 1 file changed, 6 insertions(+)

Comment 6 Mikle Kolyada (RETIRED) archtester

2020-06-26 16:25:59 UTC

~riscv keyworded