Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 877005 - www-client/seamonkey: depends on obsolete <=dev-lang/rust-1.63
Summary: www-client/seamonkey: depends on obsolete <=dev-lang/rust-1.63
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Myckel Habets
URL:
Whiteboard:
Keywords: PullRequest
Depends on: 877155
Blocks: CVE-2022-36113, CVE-2022-36114
  Show dependency tree
 
Reported: 2022-10-13 18:02 UTC by Sam James
Modified: 2022-10-25 12:49 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-10-13 18:02:54 UTC
Please test with >= Rust 1.64.0 and adjust the dependency accordingly.

Older Rust must be cleaned up for a security bug.
Comment 1 Larry the Git Cow gentoo-dev 2022-10-13 18:05:15 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1304f4bcd2909cf2a8445f0563dc76c8f7888148

commit 1304f4bcd2909cf2a8445f0563dc76c8f7888148
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-13 18:04:43 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-13 18:05:10 +0000

    profiles: mask www-client/seamonkey temporarily due to old Rust dep
    
    Older vulnerable versions of Rust have been cleaned up.
    
    Bug: https://bugs.gentoo.org/877005
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/package.mask | 5 +++++
 1 file changed, 5 insertions(+)
Comment 2 Ionen Wolkens gentoo-dev 2022-10-13 18:51:57 UTC
Just tried building with rust-1.64, unsure if it's the issues was running into but it failed at first with:

  terminate called after throwing an instance of 'std::runtime_error'
    what():  Segments overlap

I tried again with --disable-elf-hack and:

  >>> www-client/seamonkey-2.53.14 merged
  $ rustc --version
  rustc 1.64.0 (gentoo)

USE for reference (did not try everything):
[ebuild   R   ] www-client/seamonkey-2.53.14  USE="chatzilla gmp-autoupdate ipc jack system-av1 system-harfbuzz system-icu system-jpeg system-libevent system-libvpx system-png system-sqlite -custom-cflags -custom-optimization -dbus (-lto) -pulseaudio (-selinux) -startup-notification -test -webrtc -wifi" L10N="-cs -de -en-GB -es-AR -es-ES -fr -hu -it -ja -lt -nl -pl -pt-PT -ru -sk -sv -zh-CN -zh-TW"
Comment 3 Myckel Habets 2022-10-14 07:08:12 UTC
Upstream just added 1.63 support with seamonkey-2.53.14. I'll discuss this with upstream.
Comment 4 Myckel Habets 2022-10-14 07:38:32 UTC
(In reply to Ionen Wolkens from comment #2)
> Just tried building with rust-1.64, unsure if it's the issues was running
> into but it failed at first with:
> 
>   terminate called after throwing an instance of 'std::runtime_error'
>     what():  Segments overlap
> 
> I tried again with --disable-elf-hack and:
> 
>   >>> www-client/seamonkey-2.53.14 merged
>   $ rustc --version
>   rustc 1.64.0 (gentoo)
> 
> USE for reference (did not try everything):
> [ebuild   R   ] www-client/seamonkey-2.53.14  USE="chatzilla gmp-autoupdate
> ipc jack system-av1 system-harfbuzz system-icu system-jpeg system-libevent
> system-libvpx system-png system-sqlite -custom-cflags -custom-optimization
> -dbus (-lto) -pulseaudio (-selinux) -startup-notification -test -webrtc
> -wifi" L10N="-cs -de -en-GB -es-AR -es-ES -fr -hu -it -ja -lt -nl -pl -pt-PT
> -ru -sk -sv -zh-CN -zh-TW"


Ok, elfhack has been a mess and as far as I know only AMD64 works with this (other archs are broken). So, the best solution is --disable-elf-hack for all architectures?
Comment 5 Joonas Niilola gentoo-dev 2022-10-14 07:59:36 UTC
Sounds good I guess. Even in firefox it's disabled unless compiled with gcc, if I remember correctly.
Comment 6 Ionen Wolkens gentoo-dev 2022-10-14 08:16:03 UTC
Can't say for what's best myself, but personally wouldn't overly worry about barely noticeable startup optimizations (which is all elf hack does afaik?) if they're going to break a package that's already difficult to keep afloat.
Comment 7 Myckel Habets 2022-10-14 16:43:58 UTC
(In reply to Ionen Wolkens from comment #2)
> Just tried building with rust-1.64, unsure if it's the issues was running
> into but it failed at first with:
> 
>   terminate called after throwing an instance of 'std::runtime_error'
>     what():  Segments overlap
> 
> I tried again with --disable-elf-hack and:
> 
>   >>> www-client/seamonkey-2.53.14 merged
>   $ rustc --version
>   rustc 1.64.0 (gentoo)
> 
> USE for reference (did not try everything):
> [ebuild   R   ] www-client/seamonkey-2.53.14  USE="chatzilla gmp-autoupdate
> ipc jack system-av1 system-harfbuzz system-icu system-jpeg system-libevent
> system-libvpx system-png system-sqlite -custom-cflags -custom-optimization
> -dbus (-lto) -pulseaudio (-selinux) -startup-notification -test -webrtc
> -wifi" L10N="-cs -de -en-GB -es-AR -es-ES -fr -hu -it -ja -lt -nl -pl -pt-PT
> -ru -sk -sv -zh-CN -zh-TW"

Ok, tried on AMD64 myself, but didn't encounter any issues after changing the ebuild to use rust-1.64. My guess is that the elf-hack error is unrelated to rust-1.64 (or caused by some corner case that I didn't test).
Comment 8 Larry the Git Cow gentoo-dev 2022-10-14 19:42:03 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9963a2ee398cef033169ab2969ea3773cb125a13

commit 9963a2ee398cef033169ab2969ea3773cb125a13
Author:     Myckel Habets <gentoo-bugs@habets-dobben.nl>
AuthorDate: 2022-10-14 19:24:08 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-14 19:41:56 +0000

    www-client/seamonkey: support dev-lang/rust-1.64
    
    * dev-lang/rust-1.64 is supported by seamonkey-2.53.14, bump BDEPEND and check to allow this build.
    * Remove various cases of --disable-elf-hack handling and just pass --disable-elf-hack by default.
    
    Closes: https://bugs.gentoo.org/877005
    Signed-off-by: Myckel Habets <gentoo-bugs@habets-dobben.nl>
    Closes: https://github.com/gentoo/gentoo/pull/27782
    Signed-off-by: Sam James <sam@gentoo.org>

 eclass/mozcoreconf-v6.eclass                       |  9 ------
 ...-2.53.14.ebuild => seamonkey-2.53.14-r1.ebuild} | 37 ++++++----------------
 2 files changed, 9 insertions(+), 37 deletions(-)

Additionally, it has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=83dff08ee2f967649a82d54fda6aaab79fb42c82

commit 83dff08ee2f967649a82d54fda6aaab79fb42c82
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-14 19:41:48 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-14 19:41:56 +0000

    profiles: unmask newer seamonkey
    
    Bug: https://bugs.gentoo.org/877005
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/package.mask | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 9 Ionen Wolkens gentoo-dev 2022-10-15 03:39:53 UTC
(In reply to Myckel Habets from comment #7)
> Ok, tried on AMD64 myself, but didn't encounter any issues after changing
> the ebuild to use rust-1.64. My guess is that the elf-hack error is
> unrelated to rust-1.64 (or caused by some corner case that I didn't test).
Yeah could be, I didn't know why the rust limitation was added in the first place so I was just making guesses based on what I ran into.
Comment 10 Larry the Git Cow gentoo-dev 2022-10-25 12:49:57 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=76729b4b3384f69b6f1a354b0a97d80372afaf8b

commit 76729b4b3384f69b6f1a354b0a97d80372afaf8b
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-10-25 12:47:38 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-10-25 12:47:49 +0000

    profiles: cleanup obsolete seamonkey mask
    
    Bug: https://bugs.gentoo.org/877005
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/package.mask | 5 -----
 1 file changed, 5 deletions(-)