commit: 990c5f4896b309fdcaf1dbbb5779177ecfcf6e74
Author: Fabian Groffen <grobian <AT> gentoo <DOT> org>
AuthorDate: Sun Sep 28 17:52:16 2014 +0000
Commit: Fabian Groffen <grobian <AT> gentoo <DOT> org>
CommitDate: Sun Sep 28 17:52:16 2014 +0000
URL:
http://sources.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=990c5f48
Merge remote-tracking branch 'overlays-gentoo-org/master' into prefix
Conflicts:
bin/ebuild-helpers/emake
bin/misc-functions.sh
bin/portageq
doc/Makefile
pym/_emerge/EbuildBuild.py
pym/portage/const.py
pym/portage/dbapi/vartree.py
pym/portage/package/ebuild/doebuild.py
.gitignore | 1 +
.travis.yml | 13 +
DEVELOPING | 22 +-
MANIFEST.in | 18 +
Makefile | 215 ------
NEWS | 27 +-
RELEASE-NOTES | 65 +-
bin/archive-conf | 4 +-
bin/binhost-snapshot | 4 +-
bin/chpathtool.py | 8 +-
bin/clean_locks | 4 +-
bin/deprecated-path | 28 +
bin/dispatch-conf | 4 +-
bin/ebuild | 4 +-
bin/ebuild-helpers/emake | 4 +-
bin/ebuild-helpers/xattr/install | 27 +-
bin/ebuild-ipc.py | 20 +-
bin/ebuild.sh | 131 ++--
bin/egencache | 4 +-
bin/emaint | 4 +-
bin/emerge | 14 +-
bin/emerge-webrsync | 4 +-
bin/env-update | 4 +-
bin/fixpackages | 4 +-
bin/glsa-check | 4 +-
bin/install-qa-check.d/05double-D | 17 +
bin/install-qa-check.d/05prefix | 118 +++
bin/install-qa-check.d/10executable-issues | 140 ++++
bin/install-qa-check.d/10ignored-flags | 99 +++
bin/install-qa-check.d/20deprecated-directories | 18 +
bin/install-qa-check.d/20runtime-directories | 26 +
bin/install-qa-check.d/60bash-completion | 130 ++++
bin/install-qa-check.d/60openrc | 41 ++
bin/install-qa-check.d/60pkgconfig | 15 +
bin/install-qa-check.d/60pngfix | 35 +
bin/install-qa-check.d/60systemd | 25 +
bin/install-qa-check.d/60udev | 21 +
bin/install-qa-check.d/80libraries | 167 +++++
bin/install-qa-check.d/80multilib-strict | 50 ++
bin/install-qa-check.d/90gcc-warnings | 168 +++++
bin/install-qa-check.d/90world-writable | 27 +
bin/misc-functions.sh | 800 +--------------------
bin/phase-functions.sh | 153 ++--
bin/phase-helpers.sh | 40 +-
bin/portageq | 339 +++++----
bin/quickpkg | 8 +-
bin/regenworld | 4 +-
bin/repoman | 32 +-
bin/save-ebuild-env.sh | 2 +-
bin/xattr-helper.py | 6 +-
cnf/sets/portage.conf | 5 +
doc/Makefile | 13 -
doc/fragment/version | 1 -
man/emerge.1 | 19 +-
man/repoman.1 | 4 +
misc/emerge-delta-webrsync | 4 +-
mkrelease.sh | 141 ----
pym/_emerge/Binpkg.py | 9 +-
pym/_emerge/EbuildBuild.py | 6 +-
pym/_emerge/FakeVartree.py | 4 +-
pym/_emerge/MiscFunctionsProcess.py | 6 +-
pym/_emerge/PackageMerge.py | 5 +-
pym/_emerge/Scheduler.py | 2 +-
pym/_emerge/UserQuery.py | 71 ++
pym/_emerge/actions.py | 60 +-
pym/_emerge/depgraph.py | 380 ++++++++--
pym/_emerge/main.py | 18 +-
pym/_emerge/post_emerge.py | 5 +-
pym/_emerge/resolver/output_helpers.py | 2 +-
pym/_emerge/resolver/package_tracker.py | 2 +-
pym/_emerge/sync/old_tree_timestamp.py | 12 +-
pym/_emerge/unmerge.py | 8 +-
pym/_emerge/userquery.py | 55 --
pym/portage/__init__.py | 16 +-
pym/portage/_emirrordist/FetchTask.py | 6 +-
pym/portage/_global_updates.py | 4 +-
pym/portage/_sets/dbapi.py | 85 ++-
pym/portage/cache/sqlite.py | 4 +-
pym/portage/const.py | 12 +-
pym/portage/dbapi/__init__.py | 6 +-
pym/portage/dbapi/vartree.py | 25 +-
pym/portage/dep/_slot_operator.py | 27 +-
pym/portage/dep/dep_check.py | 20 +-
pym/portage/dispatch_conf.py | 3 +-
pym/portage/emaint/main.py | 6 +-
pym/portage/emaint/module.py | 2 +-
pym/portage/emaint/modules/binhost/__init__.py | 8 +-
pym/portage/emaint/modules/config/__init__.py | 8 +-
pym/portage/emaint/modules/logs/__init__.py | 8 +-
pym/portage/emaint/modules/merges/__init__.py | 31 +
pym/portage/emaint/modules/merges/merges.py | 290 ++++++++
pym/portage/emaint/modules/move/__init__.py | 8 +-
pym/portage/emaint/modules/move/move.py | 5 +-
pym/portage/emaint/modules/resume/__init__.py | 6 +-
pym/portage/emaint/modules/world/__init__.py | 8 +-
pym/portage/exception.py | 4 +
pym/portage/localization.py | 7 +-
pym/portage/mail.py | 12 +-
pym/portage/news.py | 8 +-
pym/portage/output.py | 6 +-
pym/portage/package/ebuild/config.py | 17 +-
pym/portage/package/ebuild/doebuild.py | 9 +-
pym/portage/tests/__init__.py | 24 +-
.../date => pym/portage/tests/bin/__test__.py | 0
.../tests/{bin/__test__ => dbapi/__test__.py} | 0
pym/portage/tests/dbapi/test_portdb_cache.py | 23 +-
.../tests/{dbapi/__test__ => dep/__test__.py} | 0
.../tests/{dep/__test__ => ebuild/__test__.py} | 0
pym/portage/tests/ebuild/test_config.py | 71 +-
.../tests/{ebuild/__test__ => emerge/__test__.py} | 0
pym/portage/tests/emerge/test_emerge_slot_abi.py | 7 +-
pym/portage/tests/emerge/test_simple.py | 36 +-
.../tests/{emerge/__test__ => env/__test__.py} | 0
.../tests/env/{__test__ => config/__test__.py} | 0
.../{env/config/__test__ => glsa/__test__.py} | 0
pym/portage/tests/glsa/test_security_set.py | 3 +-
.../{glsa/__test__ => lafilefixer/__test__.py} | 0
.../__test__ => lazyimport/__test__.py} | 0
.../{lazyimport/__test__ => lint/__test__.py} | 0
pym/portage/tests/lint/test_compile_modules.py | 10 +-
pym/portage/tests/lint/test_import_modules.py | 8 +-
.../tests/{lint/__test__ => locks/__test__.py} | 0
.../tests/{locks/__test__ => news/__test__.py} | 0
.../tests/{news/__test__ => process/__test__.py} | 0
.../{process/__test__ => repoman/__test__.py} | 0
pym/portage/tests/repoman/test_simple.py | 8 +-
pym/portage/tests/resolver/ResolverPlayground.py | 59 +-
.../{repoman/__test__ => resolver/__test__.py} | 0
.../tests/resolver/test_autounmask_use_breakage.py | 63 ++
pym/portage/tests/resolver/test_or_choices.py | 73 ++
...fied.py => test_slot_conflict_force_rebuild.py} | 56 +-
.../test_slot_conflict_unsatisfied_deep_deps.py | 115 +++
...nsatisfied.py => test_slot_operator_rebuild.py} | 52 +-
.../resolver/test_slot_operator_required_use.py | 72 ++
...test_solve_non_slot_operator_slot_conflicts.py} | 49 +-
pym/portage/tests/{runTests => runTests.py} | 0
.../{resolver/__test__ => sets/base/__test__.py} | 0
.../sets/{base/__test__ => files/__test__.py} | 0
.../sets/{files/__test__ => shell/__test__.py} | 0
.../{sets/shell/__test__ => unicode/__test__.py} | 0
.../tests/{unicode/__test__ => update/__test__.py} | 0
.../tests/{update/__test__ => util/__test__.py} | 0
pym/portage/tests/util/test_getconfig.py | 4 +-
.../tests/{util/__test__ => versions/__test__.py} | 0
pym/portage/tests/xpak/__test__ | 0
.../tests/{versions/__test__ => xpak/__test__.py} | 0
pym/portage/util/__init__.py | 3 +-
pym/portage/util/_eventloop/EventLoop.py | 8 +-
pym/portage/util/_eventloop/PollSelectAdapter.py | 6 +-
pym/repoman/checks.py | 16 -
runtests.sh | 8 +-
setup.py | 652 +++++++++++++++++
testpath | 11 +
153 files changed, 4118 insertions(+), 1920 deletions(-)
diff --cc bin/ebuild-helpers/emake
index 60286ec,4618053..dcb64a3
--- a/bin/ebuild-helpers/emake
+++ b/bin/ebuild-helpers/emake
@@@ -22,7 -22,7 +22,7 @@@ if [[ $PORTAGE_QUIET != 1 ]] ; the
) >&2
fi
- ${MAKE:-make} SHELL="${BASH:-/bin/bash}" ${MAKEOPTS} ${EXTRA_EMAKE} "$@"
-${MAKE:-make} ${MAKEOPTS} "$@" ${EXTRA_EMAKE}
++${MAKE:-make} SHELL="${BASH:-/bin/bash}" ${MAKEOPTS} "$@" ${EXTRA_EMAKE}
ret=$?
[[ $ret -ne 0 ]] && __helpers_die "${0##*/} failed"
exit $ret
diff --cc bin/install-qa-check.d/05prefix
index 0000000,e1fc2bd..32561e2
mode 000000,100644..100644
--- a/bin/install-qa-check.d/05prefix
+++ b/bin/install-qa-check.d/05prefix
@@@ -1,0 -1,117 +1,118 @@@
+ # Prefix specific QA checks
+
+ install_qa_check_prefix() {
+ [[ ${ED} == ${D} ]] && return
+
+ if [[ -d ${ED}/${D} ]] ; then
+ find "${ED}/${D}" | \
+ while read i ; do
+ eqawarn "QA Notice: /${i##${ED}/${D}} installed in
\${ED}/\${D}"
+ done
+ die "Aborting due to QA concerns: files installed in ${ED}/${D}"
+ fi
+
+ if [[ -d ${ED}/${EPREFIX} ]] ; then
+ find "${ED}/${EPREFIX}/" | \
+ while read i ; do
+ eqawarn "QA Notice: ${i#${D}} double prefix"
+ done
+ die "Aborting due to QA concerns: double prefix files installed"
+ fi
+
+ if [[ -d ${D} ]] ; then
+ INSTALLTOD=$(find ${D%/} | egrep -v "^${ED}" | sed -e
"s|^${D%/}||" | awk '{if (length($0) <= length("'"${EPREFIX}"'")) { if
(substr("'"${EPREFIX}"'", 1, length($0)) != $0) {print $0;} } else if
(substr($0, 1, length("'"${EPREFIX}"'")) != "'"${EPREFIX}"'") {print $0;} }')
+ if [[ -n ${INSTALLTOD} ]] ; then
+ eqawarn "QA Notice: the following files are outside of
the prefix:"
+ eqawarn "${INSTALLTOD}"
+ die "Aborting due to QA concerns: there are files
installed outside the prefix"
+ fi
+ fi
+
+ # all further checks rely on ${ED} existing
+ [[ -d ${ED} ]] || return
+
+ # check shebangs, bug #282539
+ rm -f "${T}"/non-prefix-shebangs-errs
+ local WHITELIST=" /usr/bin/env "
+ # this is hell expensive, but how else?
+ find "${ED}" -executable \! -type d -print0 \
+ | xargs -0 grep -H -n -m1 "^#!" \
+ | while read f ;
+ do
+ local fn=${f%%:*}
+ local pos=${f#*:} ; pos=${pos%:*}
+ local line=${f##*:}
+ # shebang always appears on the first line ;)
+ [[ ${pos} != 1 ]] && continue
+ local oldIFS=${IFS}
+ IFS=$'\r'$'\n'$'\t'" "
+ line=( ${line#"#!"} )
+ IFS=${oldIFS}
+ [[ ${WHITELIST} == *" ${line[0]} "* ]] && continue
+ local fp=${fn#${D}} ; fp=/${fp%/*}
+ # line[0] can be an absolutised path, bug #342929
+ local eprefix=$(canonicalize ${EPREFIX})
+ local rf=${fn}
+ # in case we deal with a symlink, make sure we don't replace it
+ # with a real file (sed -i does that)
+ if [[ -L ${fn} ]] ; then
+ rf=$(readlink ${fn})
+ [[ ${rf} != /* ]] && rf=${fn%/*}/${rf}
+ # ignore symlinks pointing to outside prefix
+ # as seen in sys-devel/native-cctools
+ [[ $(canonicalize "/${rf#${D}}") != ${eprefix}/* ]] &&
continue
+ fi
+ # does the shebang start with ${EPREFIX}, and does it exist?
+ if [[ ${line[0]} == ${EPREFIX}/* || ${line[0]} == ${eprefix}/*
]] ; then
+ if [[ ! -e ${ROOT%/}${line[0]} && ! -e ${D%/}${line[0]}
]] ; then
+ # hmm, refers explicitly to $EPREFIX, but
doesn't exist,
+ # if it's in PATH that's wrong in any case
+ if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
+ echo "${fn#${D}}:${line[0]} (explicit
EPREFIX but target not found)" \
+ >>
"${T}"/non-prefix-shebangs-errs
+ else
+ eqawarn "${fn#${D}} has explicit
EPREFIX in shebang but target not found (${line[0]})"
+ fi
+ fi
+ continue
+ fi
- # unprefixed shebang, is the script directly in $PATH?
- if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
++ # unprefixed shebang, is the script directly in $PATH or an init
++ # script?
++ if [[ ":${PATH}:${EPREFIX}/etc/init.d:" == *":${fp}:"* ]] ; then
+ if [[ -e ${EROOT}${line[0]} || -e ${ED}${line[0]} ]] ;
then
+ # is it unprefixed, but we can just fix it
because a
+ # prefixed variant exists
+ eqawarn "prefixing shebang of ${fn#${D}}"
+ # statement is made idempotent on purpose,
because
+ # symlinks may point to the same target, and
hence the
+ # same real file may be sedded multiple times
since we
+ # read the shebangs in one go upfront for
performance
+ # reasons
+ sed -i -e '1s:^#!
\?'"${line[0]}"':#!'"${EPREFIX}"${line[0]}':' "${rf}"
+ continue
+ else
+ # this is definitely wrong: script in $PATH and
invalid shebang
+ echo "${fn#${D}}:${line[0]} (script ${fn##*/}
installed in PATH but interpreter ${line[0]} not found)" \
+ >> "${T}"/non-prefix-shebangs-errs
+ fi
+ else
+ # unprefixed/invalid shebang, but outside $PATH, this
may be
+ # intended (e.g. config.guess) so remain silent by
default
+ has stricter ${FEATURES} && \
+ eqawarn "invalid shebang in ${fn#${D}}:
${line[0]}"
+ fi
+ done
+ if [[ -e "${T}"/non-prefix-shebangs-errs ]] ; then
+ eqawarn "QA Notice: the following files use invalid (possible
non-prefixed) shebangs:"
+ while read line ; do
+ eqawarn " ${line}"
+ done < "${T}"/non-prefix-shebangs-errs
+ rm -f "${T}"/non-prefix-shebangs-errs
+ die "Aborting due to QA concerns: invalid shebangs found"
+ fi
+ }
+
+ install_qa_check_prefix
+ : # guarantee successful exit
+
+ # vim:ft=sh
diff --cc bin/install-qa-check.d/80libraries
index 0000000,3977bae..c83f278
mode 000000,100644..100644
--- a/bin/install-qa-check.d/80libraries
+++ b/bin/install-qa-check.d/80libraries
@@@ -1,0 -1,158 +1,167 @@@
+ # Check for issues with installed libraries
+
+ lib_check() {
+ local f x i j
+
+ if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT}; then
+ # Check for shared libraries lacking SONAMEs
+ local qa_var="QA_SONAME_${ARCH/-/_}"
+ eval "[[ -n \${!qa_var} ]] && QA_SONAME=(\"\${${qa_var}[@]}\")"
+ f=$(scanelf -ByF '%S %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2
== "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
+ if [[ -n ${f} ]] ; then
+ echo "${f}" > "${T}"/scanelf-missing-SONAME.log
+ if [[ "${QA_STRICT_SONAME-unset}" == unset ]] ; then
+ if [[ ${#QA_SONAME[@]} -gt 1 ]] ; then
+ for x in "${QA_SONAME[@]}" ; do
+ sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-SONAME.log
+ done
+ else
+ local shopts=$-
+ set -o noglob
+ for x in ${QA_SONAME} ; do
+ sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-SONAME.log
+ done
+ set +o noglob
+ set -${shopts}
+ fi
+ fi
+ sed -e "/^\$/d" -i "${T}"/scanelf-missing-SONAME.log
+ f=$(<"${T}"/scanelf-missing-SONAME.log)
+ if [[ -n ${f} ]] ; then
+ __vecho -ne '\n'
+ eqawarn "QA Notice: The following shared
libraries lack a SONAME"
+ eqawarn "${f}"
+ __vecho -ne '\n'
+ sleep 1
+ else
+ rm -f "${T}"/scanelf-missing-SONAME.log
+ fi
+ fi
+
+ # Check for shared libraries lacking NEEDED entries
+ qa_var="QA_DT_NEEDED_${ARCH/-/_}"
+ eval "[[ -n \${!qa_var} ]] &&
QA_DT_NEEDED=(\"\${${qa_var}[@]}\")"
+ f=$(scanelf -ByF '%n %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2
== "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
+ if [[ -n ${f} ]] ; then
+ echo "${f}" > "${T}"/scanelf-missing-NEEDED.log
+ if [[ "${QA_STRICT_DT_NEEDED-unset}" == unset ]] ; then
+ if [[ ${#QA_DT_NEEDED[@]} -gt 1 ]] ; then
+ for x in "${QA_DT_NEEDED[@]}" ; do
+ sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-NEEDED.log
+ done
+ else
+ local shopts=$-
+ set -o noglob
+ for x in ${QA_DT_NEEDED} ; do
+ sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-NEEDED.log
+ done
+ set +o noglob
+ set -${shopts}
+ fi
+ fi
+ sed -e "/^\$/d" -i "${T}"/scanelf-missing-NEEDED.log
+ f=$(<"${T}"/scanelf-missing-NEEDED.log)
+ if [[ -n ${f} ]] ; then
+ __vecho -ne '\n'
+ eqawarn "QA Notice: The following shared
libraries lack NEEDED entries"
+ eqawarn "${f}"
+ __vecho -ne '\n'
+ sleep 1
+ else
+ rm -f "${T}"/scanelf-missing-NEEDED.log
+ fi
+ fi
+ fi
+
+ # this should help to ensure that all (most?) shared libraries are
executable
+ # and that all libtool scripts / static libraries are not executable
+ for i in "${ED}"opt/*/lib* \
+ "${ED}"lib* \
+ "${ED}"usr/lib* ; do
+ [[ ! -d ${i} ]] && continue
+
+ for j in "${i}"/*.so.* "${i}"/*.so ; do
+ [[ ! -e ${j} ]] && continue
+ [[ -L ${j} ]] && continue
+ [[ -x ${j} ]] && continue
+ __vecho "making executable: ${j#${ED}}"
+ chmod +x "${j}"
+ done
+
+ for j in "${i}"/*.a "${i}"/*.la ; do
+ [[ ! -e ${j} ]] && continue
+ [[ -L ${j} ]] && continue
+ [[ ! -x ${j} ]] && continue
+ __vecho "removing executable bit: ${j#${ED}}"
+ chmod -x "${j}"
+ done
+
+ for j in "${i}"/*.{a,dll,dylib,sl,so}.*
"${i}"/*.{a,dll,dylib,sl,so} ; do
+ [[ ! -e ${j} ]] && continue
+ [[ ! -L ${j} ]] && continue
+ linkdest=$(readlink "${j}")
+ if [[ ${linkdest} == /* ]] ; then
+ __vecho -ne '\n'
+ eqawarn "QA Notice: Found an absolute symlink
in a library directory:"
+ eqawarn " ${j#${D}} -> ${linkdest}"
+ eqawarn " It should be a relative
symlink if in the same directory"
+ eqawarn " or a linker script if it
crosses the /usr boundary."
+ fi
+ done
+ done
+
+ # When installing static libraries into /usr/lib and shared libraries
into
+ # /lib, we have to make sure we have a linker script in /usr/lib along
side
+ # the static library, or gcc will utilize the static lib when linking
:(.
+ # http://bugs.gentoo.org/4411
+ local abort="no"
+ local a s
+ for a in "${ED}"usr/lib*/*.a ; do
- s=${a%.a}.so
++ # PREFIX LOCAL: support MachO objects
++ [[ ${CHOST} == *-darwin* ]] \
++ && s=${a%.a}.dylib \
++ || s=${a%.a}.so
++ # END PREFIX LOCAL
+ if [[ ! -e ${s} ]] ; then
+ s=${s%usr/*}${s##*/usr/}
+ if [[ -e ${s} ]] ; then
+ __vecho -ne '\n'
+ eqawarn "QA Notice: Missing gen_usr_ldscript
for ${s##*/}"
+ abort="yes"
+ fi
+ fi
+ done
+ [[ ${abort} == "yes" ]] && die "add those ldscripts"
+
+ # Make sure people don't store libtool files or static libs in /lib
- f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
++ # PREFIX LOCAL: on AIX, "dynamic libs" have extension .a, so don't
++ # get false positives
++ [[ ${CHOST} == *-aix* ]] \
++ && f=$(ls "${ED}"lib*/*.la 2>/dev/null || true) \
++ || f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
++ # END PREFIX LOCAL
+ if [[ -n ${f} ]] ; then
+ __vecho -ne '\n'
+ eqawarn "QA Notice: Excessive files found in the / partition"
+ eqawarn "${f}"
+ __vecho -ne '\n'
+ die "static archives (*.a) and libtool library files (*.la)
belong in /usr/lib*, not /lib*"
+ fi
+
+ # Verify that the libtool files don't contain bogus $D entries.
+ local abort=no gentoo_bug=no always_overflow=no
+ for a in "${ED}"usr/lib*/*.la ; do
+ s=${a##*/}
+ if grep -qs "${ED}" "${a}" ; then
+ __vecho -ne '\n'
+ eqawarn "QA Notice: ${s} appears to contain
PORTAGE_TMPDIR paths"
+ abort="yes"
+ fi
+ done
+ [[ ${abort} == "yes" ]] && die "soiled libtool library files found"
+ }
+
+ lib_check
+ : # guarantee successful exit
+
+ # vim:ft=sh
diff --cc bin/install-qa-check.d/80multilib-strict
index 0000000,f944be9..436932e
mode 000000,100644..100644
--- a/bin/install-qa-check.d/80multilib-strict
+++ b/bin/install-qa-check.d/80multilib-strict
@@@ -1,0 -1,50 +1,50 @@@
+ # Strict multilib directory checks
+ multilib_strict_check() {
+ if has multilib-strict ${FEATURES} && \
- [[ -x /usr/bin/file && -x /usr/bin/find ]] && \
++ [[ -x ${EPREFIX}/usr/bin/file && -x ${EPREFIX}/usr/bin/find ]] && \
+ [[ -n ${MULTILIB_STRICT_DIRS} && -n ${MULTILIB_STRICT_DENY} ]]
+ then
+ rm -f "${T}/multilib-strict.log"
+ local abort=no dir file
+ MULTILIB_STRICT_EXEMPT=$(echo ${MULTILIB_STRICT_EXEMPT} | sed
-e 's:\([(|)]\):\\\1:g')
+ for dir in ${MULTILIB_STRICT_DIRS} ; do
+ [[ -d ${ED}/${dir} ]] || continue
+ for file in $(find ${ED}/${dir} -type f | grep -v
"^${ED}/${dir}/${MULTILIB_STRICT_EXEMPT}"); do
+ if file ${file} | egrep -q
"${MULTILIB_STRICT_DENY}" ; then
+ echo "${file#${ED}//}" >>
"${T}/multilib-strict.log"
+ fi
+ done
+ done
+
+ if [[ -s ${T}/multilib-strict.log ]] ; then
+ if [[ ${#QA_MULTILIB_PATHS[@]} -eq 1 ]] ; then
+ local shopts=$-
+ set -o noglob
+ QA_MULTILIB_PATHS=(${QA_MULTILIB_PATHS})
+ set +o noglob
+ set -${shopts}
+ fi
+ if [ "${QA_STRICT_MULTILIB_PATHS-unset}" = unset ] ;
then
+ local x
+ for x in "${QA_MULTILIB_PATHS[@]}" ; do
+ sed -e "s#^${x#/}\$##" -i
"${T}/multilib-strict.log"
+ done
+ sed -e "/^\$/d" -i "${T}/multilib-strict.log"
+ fi
+ if [[ -s ${T}/multilib-strict.log ]] ; then
+ abort=yes
+ echo "Files matching a file type that is not
allowed:"
+ while read -r ; do
+ echo " ${REPLY}"
+ done < "${T}/multilib-strict.log"
+ fi
+ fi
+
+ [[ ${abort} == yes ]] && die "multilib-strict check failed!"
+ fi
+ }
+
+ multilib_strict_check
+ : # guarantee successful exit
+
+ # vim:ft=sh
diff --cc bin/install-qa-check.d/90world-writable
index 0000000,771027e..635612d
mode 000000,100644..100644
--- a/bin/install-qa-check.d/90world-writable
+++ b/bin/install-qa-check.d/90world-writable
@@@ -1,0 -1,25 +1,27 @@@
+ # Check for world-writable files
+
+ world_writable_check() {
+ # Now we look for all world writable files.
- local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${ED}:-
:")
++ # PREFIX LOCAL: keep offset prefix in the reported files
++ local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${D}:-
:")
++ # END PREFIX LOCAL
+ if [[ -n ${unsafe_files} ]] ; then
+ __vecho "QA Security Notice: world writable file(s):"
+ __vecho "${unsafe_files}"
+ __vecho "- This may or may not be a security problem, most of
the time it is one."
+ __vecho "- Please double check that $PF really needs a world
writeable bit and file bugs accordingly."
+ sleep 1
+ fi
+
- local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm
-4002 ')' | sed -e "s:^${ED}:/:")
++ local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm
-4002 ')' | sed -e "s:^${D}:/:")
+ if [[ -n ${unsafe_files} ]] ; then
+ eqawarn "QA Notice: Unsafe files detected (set*id and world
writable)"
+ eqawarn "${unsafe_files}"
+ die "Unsafe files found in \${D}. Portage will not install
them."
+ fi
+ }
+
+ world_writable_check
+ : # guarantee successful exit
+
+ # vim:ft=sh
diff --cc bin/misc-functions.sh
index d92103f,cc652a9..1904c25
mode 100644,100755..100644
--- a/bin/misc-functions.sh
+++ b/bin/misc-functions.sh
@@@ -1,5 -1,5 +1,5 @@@
-#!/bin/bash
+#!@PORTAGE_BASH@
- # Copyright 1999-2013 Gentoo Foundation
+ # Copyright 1999-2014 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
#
# Miscellaneous shell functions that make use of the ebuild env but don't need
@@@ -172,67 -168,34 +172,36 @@@ install_qa_check()
local EPREFIX= ED=${D}
fi
- cd "${ED}" || die "cd failed"
+ # PREFIX LOCAL: ED needs not to exist, whereas D does
+ cd "${D}" || die "cd failed"
+ # END PREFIX LOCAL
- qa_var="QA_FLAGS_IGNORED_${ARCH/-/_}"
- eval "[[ -n \${!qa_var} ]] && QA_FLAGS_IGNORED=(\"\${${qa_var}[@]}\")"
- if [[ ${#QA_FLAGS_IGNORED[@]} -eq 1 ]] ; then
- local shopts=$-
- set -o noglob
- QA_FLAGS_IGNORED=(${QA_FLAGS_IGNORED})
- set +o noglob
- set -${shopts}
- fi
+ # Run QA checks from install-qa-check.d.
+ # Note: checks need to be run *before* stripping.
+ local f
+ # TODO: handle nullglob-like
+ for f in "${PORTAGE_BIN_PATH}"/install-qa-check.d/*; do
+ # Run in a subshell to treat it like external script,
+ # but use 'source' to pass all variables through.
+ (
+ source "${f}" || eerror "Post-install QA check ${f##*/}
failed to run"
+ )
+ done
- # Check for files built without respecting *FLAGS. Note that
- # -frecord-gcc-switches must be in all *FLAGS variables, in
- # order to avoid false positive results here.
- # NOTE: This check must execute before prepall/prepstrip, since
- # prepstrip strips the .GCC.command.line sections.
- if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT} && \
- [[ "${CFLAGS}" == *-frecord-gcc-switches* ]] && \
- [[ "${CXXFLAGS}" == *-frecord-gcc-switches* ]] && \
- [[ "${FFLAGS}" == *-frecord-gcc-switches* ]] && \
- [[ "${FCFLAGS}" == *-frecord-gcc-switches* ]] ; then
- rm -f "${T}"/scanelf-ignored-CFLAGS.log
- for x in $(scanelf -qyRF '#k%p' -k '!.GCC.command.line'
"${ED}") ; do
- # Separate out file types that are known to support
- # .GCC.command.line sections, using the `file` command
- # similar to how prepstrip uses it.
- f=$(file "${x}") || continue
- [[ -z ${f} ]] && continue
- if [[ ${f} == *"SB executable"* ||
- ${f} == *"SB shared object"* ]] ; then
- echo "${x}" >> "${T}"/scanelf-ignored-CFLAGS.log
+ # Run QA checks from repositories
+ # (yes, PORTAGE_ECLASS_LOCATIONS contains repo paths...)
+ local repo_location
+ for repo_location in "${PORTAGE_ECLASS_LOCATIONS[@]}"; do
+ for f in "${repo_location}"/metadata/install-qa-check.d/*; do
+ if [[ -f ${f} ]]; then
+ (
+ # allow inheriting eclasses
+ _IN_INSTALL_QA_CHECK=1
+ source "${f}" || eerror "Post-install
QA check ${f##*/} failed to run"
+ )
fi
done
-
- if [[ -f "${T}"/scanelf-ignored-CFLAGS.log ]] ; then
-
- if [ "${QA_STRICT_FLAGS_IGNORED-unset}" = unset ] ; then
- for x in "${QA_FLAGS_IGNORED[@]}" ; do
- sed -e "s#^${x#/}\$##" -i
"${T}"/scanelf-ignored-CFLAGS.log
- done
- fi
- # Filter anything under /usr/lib/debug/ in order to
avoid
- # duplicate warnings for splitdebug files.
- sed -e "s#^usr/lib/debug/.*##" -e "/^\$/d" -e "s#^#/#" \
- -i "${T}"/scanelf-ignored-CFLAGS.log
- f=$(<"${T}"/scanelf-ignored-CFLAGS.log)
- if [[ -n ${f} ]] ; then
- __vecho -ne '\n'
- eqawarn "${BAD}QA Notice: Files built without
respecting CFLAGS have been detected${NORMAL}"
- eqawarn " Please include the following list of
files in your report:"
- eqawarn "${f}"
- __vecho -ne '\n'
- sleep 1
- else
- rm -f "${T}"/scanelf-ignored-CFLAGS.log
- fi
- fi
- fi
+ done
export STRIP_MASK
prepall
@@@ -240,327 -203,6 +209,39 @@@
ecompressdir --dequeue
ecompress --dequeue
- # Prefix specific checks
- [[ ${ED} != ${D} ]] && install_qa_check_prefix
-
- f=
- for x in etc/app-defaults usr/man usr/info usr/X11R6 usr/doc usr/locale
; do
- [[ -d ${ED}/$x ]] && f+=" $x\n"
- done
- if [[ -n $f ]] ; then
- eqawarn "QA Notice: This ebuild installs into the following
deprecated directories:"
- eqawarn
- eqawarn "$f"
- fi
-
- # It's ok create these directories, but not to install into them.
#493154
- # TODO: We should add var/lib to this list.
- f=
- for x in var/cache var/lock var/run run ; do
- if [[ ! -L ${ED}/${x} && -d ${ED}/${x} ]] ; then
- if [[ -z $(find "${ED}/${x}" -prune -empty) ]] ; then
- f+=$(cd "${ED}"; find "${x}" -printf ' %p\n')
- fi
- fi
- done
- if [[ -n ${f} ]] ; then
- eqawarn "QA Notice: This ebuild installs into paths that should
be created at runtime."
- eqawarn " To fix, simply do not install into these directories.
Instead, your package"
- eqawarn " should create dirs on the fly at runtime as needed
via init scripts/etc..."
- eqawarn
- eqawarn "${f}"
- fi
-
- set +f
- f=
- for x in "${ED}etc/udev/rules.d/"* "${ED}lib"*"/udev/rules.d/"* ; do
- [[ -e ${x} ]] || continue
- [[ ${x} == ${ED}lib/udev/rules.d/* ]] && continue
- f+=" ${x#${ED}}\n"
- done
- if [[ -n $f ]] ; then
- eqawarn "QA Notice: udev rules should be installed in
/lib/udev/rules.d:"
- eqawarn
- eqawarn "$f"
- fi
-
- # Now we look for all world writable files.
- # PREFIX LOCAL: keep offset in the paths
- local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${D}:-
:")
- # END PREFIX LOCAL
- if [[ -n ${unsafe_files} ]] ; then
- __vecho "QA Security Notice: world writable file(s):"
- __vecho "${unsafe_files}"
- __vecho "- This may or may not be a security problem, most of
the time it is one."
- __vecho "- Please double check that $PF really needs a world
writeable bit and file bugs accordingly."
- sleep 1
- fi
-
+ # PREFIX LOCAL:
+ # anything outside the prefix should be caught by the Prefix QA
+ # check, so if there's nothing in ED, we skip searching for QA
+ # checks there, the specific QA funcs can hence rely on ED existing
+ if [[ -d ${ED} ]] ; then
+ case ${CHOST} in
+ *-darwin*)
+ # Mach-O platforms (NeXT, Darwin, OSX)
+ install_qa_check_macho
+ ;;
+ *-interix*|*-winnt*)
+ # PECOFF platforms (Windows/Interix)
+ install_qa_check_pecoff
+ ;;
+ *-aix*)
+ # XCOFF platforms (AIX)
+ install_qa_check_xcoff
+ ;;
+ *)
+ # because this is the majority: ELF platforms
(Linux,
+ # Solaris, *BSD, IRIX, etc.)
+ install_qa_check_elf
+ ;;
+ esac
+ fi
+
+ # this is basically here such that the diff with trunk remains just
+ # offsetted and not out of order
+ install_qa_check_misc
+ # END PREFIX LOCAL
+}
+
+install_qa_check_elf() {
- if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT}; then
- local insecure_rpath=0 tmp_quiet=${PORTAGE_QUIET}
- local x
-
- # display warnings when using stricter because we die afterwards
- if has stricter ${FEATURES} ; then
- unset PORTAGE_QUIET
- fi
-
- # Make sure we disallow insecure RUNPATH/RPATHs.
- # 1) References to PORTAGE_BUILDDIR are banned because it's a
- # security risk. We don't want to load files from a
- # temporary directory.
- # 2) If ROOT != "/", references to ROOT are banned because
- # that directory won't exist on the target system.
- # 3) Null paths are banned because the loader will search
$PWD when
- # it finds null paths.
- local forbidden_dirs="${PORTAGE_BUILDDIR}"
- if [[ -n "${ROOT}" && "${ROOT}" != "/" ]]; then
- forbidden_dirs+=" ${ROOT}"
- fi
- local dir l rpath_files=$(scanelf -F '%F:%r' -qBR "${ED}")
- f=""
- for dir in ${forbidden_dirs}; do
- for l in $(echo "${rpath_files}" | grep -E
":${dir}|::|: "); do
- f+=" ${l%%:*}\n"
- if ! has stricter ${FEATURES}; then
- __vecho "Auto fixing rpaths for
${l%%:*}"
- TMPDIR="${dir}" scanelf -BXr "${l%%:*}"
-o /dev/null
- fi
- done
- done
-
- # Reject set*id binaries with $ORIGIN in RPATH #260331
- x=$(
- find "${ED}" -type f \( -perm -u+s -o -perm -g+s \)
-print0 | \
- xargs -0 scanelf -qyRF '%r %p' | grep '$ORIGIN'
- )
-
- # Print QA notice.
- if [[ -n ${f}${x} ]] ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: The following files contain
insecure RUNPATHs"
- eqawarn " Please file a bug about this at
http://bugs.gentoo.org/";
- eqawarn " with the maintaining herd of the package."
- eqawarn "${f}${f:+${x:+\n}}${x}"
- __vecho -ne '\n'
- if [[ -n ${x} ]] || has stricter ${FEATURES} ; then
- insecure_rpath=1
- fi
- fi
-
- # TEXTRELs are baaaaaaaad
- # Allow devs to mark things as ignorable ... e.g. things that
are
- # binary-only and upstream isn't cooperating (nvidia-glx) ... we
- # allow ebuild authors to set QA_TEXTRELS_arch and QA_TEXTRELS
...
- # the former overrides the latter ... regexes allowed ! :)
- qa_var="QA_TEXTRELS_${ARCH/-/_}"
- [[ -n ${!qa_var} ]] && QA_TEXTRELS=${!qa_var}
- [[ -n ${QA_STRICT_TEXTRELS} ]] && QA_TEXTRELS=""
- export QA_TEXTRELS="${QA_TEXTRELS} lib*/modules/*.ko"
- f=$(scanelf -qyRF '%t %p' "${ED}" | grep -v 'usr/lib/debug/')
- if [[ -n ${f} ]] ; then
- scanelf -qyRAF '%T %p' "${PORTAGE_BUILDDIR}"/ &>
"${T}"/scanelf-textrel.log
- __vecho -ne '\n'
- eqawarn "QA Notice: The following files contain runtime
text relocations"
- eqawarn " Text relocations force the dynamic linker to
perform extra"
- eqawarn " work at startup, waste system resources, and
may pose a security"
- eqawarn " risk. On some architectures, the code may
not even function"
- eqawarn " properly, if at all."
- eqawarn " For more information, see
http://hardened.gentoo.org/pic-fix-guide.xml";
- eqawarn " Please include the following list of files in
your report:"
- eqawarn "${f}"
- __vecho -ne '\n'
- die_msg="${die_msg} textrels,"
- sleep 1
- fi
-
- # Also, executable stacks only matter on linux (and just glibc
atm ...)
- f=""
- case ${CTARGET:-${CHOST}} in
- *-linux-gnu*)
- # Check for files with executable stacks, but only on
arches which
- # are supported at the moment. Keep this list in sync
with
- # http://www.gentoo.org/proj/en/hardened/gnu-stack.xml
(Arch Status)
- case ${CTARGET:-${CHOST}} in
- arm*|i?86*|ia64*|m68k*|s390*|sh*|x86_64*)
- # Allow devs to mark things as
ignorable ... e.g. things
- # that are binary-only and upstream
isn't cooperating ...
- # we allow ebuild authors to set
QA_EXECSTACK_arch and
- # QA_EXECSTACK ... the former overrides
the latter ...
- # regexes allowed ! :)
-
- qa_var="QA_EXECSTACK_${ARCH/-/_}"
- [[ -n ${!qa_var} ]] &&
QA_EXECSTACK=${!qa_var}
- [[ -n ${QA_STRICT_EXECSTACK} ]] &&
QA_EXECSTACK=""
- qa_var="QA_WX_LOAD_${ARCH/-/_}"
- [[ -n ${!qa_var} ]] &&
QA_WX_LOAD=${!qa_var}
- [[ -n ${QA_STRICT_WX_LOAD} ]] &&
QA_WX_LOAD=""
- export QA_EXECSTACK="${QA_EXECSTACK}
lib*/modules/*.ko"
- export QA_WX_LOAD="${QA_WX_LOAD}
lib*/modules/*.ko"
- f=$(scanelf -qyRAF '%e %p' "${ED}" |
grep -v 'usr/lib/debug/')
- ;;
- esac
- ;;
- esac
- if [[ -n ${f} ]] ; then
- # One more pass to help devs track down the source
- scanelf -qyRAF '%e %p' "${PORTAGE_BUILDDIR}"/ &>
"${T}"/scanelf-execstack.log
- __vecho -ne '\n'
- eqawarn "QA Notice: The following files contain
writable and executable sections"
- eqawarn " Files with such sections will not work
properly (or at all!) on some"
- eqawarn " architectures/operating systems. A bug
should be filed at"
- eqawarn " http://bugs.gentoo.org/ to make sure the
issue is fixed."
- eqawarn " For more information, see
http://hardened.gentoo.org/gnu-stack.xml";
- eqawarn " Please include the following list of files in
your report:"
- eqawarn " Note: Bugs should be filed for the respective
maintainers"
- eqawarn " of the package in question and not
[email protected]."
- eqawarn "${f}"
- __vecho -ne '\n'
- die_msg="${die_msg} execstacks"
- sleep 1
- fi
-
- # Check for files built without respecting LDFLAGS
- if [[ "${LDFLAGS}" == *,--hash-style=gnu* ]] && \
- ! has binchecks ${RESTRICT} ; then
- f=$(scanelf -qyRF '#k%p' -k .hash "${ED}")
- if [[ -n ${f} ]] ; then
- echo "${f}" > "${T}"/scanelf-ignored-LDFLAGS.log
- if [ "${QA_STRICT_FLAGS_IGNORED-unset}" = unset
] ; then
- for x in "${QA_FLAGS_IGNORED[@]}" ; do
- sed -e "s#^${x#/}\$##" -i
"${T}"/scanelf-ignored-LDFLAGS.log
- done
- fi
- # Filter anything under /usr/lib/debug/ in
order to avoid
- # duplicate warnings for splitdebug files.
- sed -e "s#^usr/lib/debug/.*##" -e "/^\$/d" -e
"s#^#/#" \
- -i "${T}"/scanelf-ignored-LDFLAGS.log
- f=$(<"${T}"/scanelf-ignored-LDFLAGS.log)
- if [[ -n ${f} ]] ; then
- __vecho -ne '\n'
- eqawarn "${BAD}QA Notice: Files built
without respecting LDFLAGS have been detected${NORMAL}"
- eqawarn " Please include the following
list of files in your report:"
- eqawarn "${f}"
- __vecho -ne '\n'
- sleep 1
- else
- rm -f "${T}"/scanelf-ignored-LDFLAGS.log
- fi
- fi
- fi
-
- if [[ ${insecure_rpath} -eq 1 ]] ; then
- die "Aborting due to serious QA concerns with
RUNPATH/RPATH"
- elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
- die "Aborting due to QA concerns: ${die_msg}"
- fi
-
- # Check for shared libraries lacking SONAMEs
- qa_var="QA_SONAME_${ARCH/-/_}"
- eval "[[ -n \${!qa_var} ]] && QA_SONAME=(\"\${${qa_var}[@]}\")"
- f=$(scanelf -ByF '%S %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2
== "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
- if [[ -n ${f} ]] ; then
- echo "${f}" > "${T}"/scanelf-missing-SONAME.log
- if [[ "${QA_STRICT_SONAME-unset}" == unset ]] ; then
- if [[ ${#QA_SONAME[@]} -gt 1 ]] ; then
- for x in "${QA_SONAME[@]}" ; do
- sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-SONAME.log
- done
- else
- local shopts=$-
- set -o noglob
- for x in ${QA_SONAME} ; do
- sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-SONAME.log
- done
- set +o noglob
- set -${shopts}
- fi
- fi
- sed -e "/^\$/d" -i "${T}"/scanelf-missing-SONAME.log
- f=$(<"${T}"/scanelf-missing-SONAME.log)
- if [[ -n ${f} ]] ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: The following shared
libraries lack a SONAME"
- eqawarn "${f}"
- __vecho -ne '\n'
- sleep 1
- else
- rm -f "${T}"/scanelf-missing-SONAME.log
- fi
- fi
-
- # Check for shared libraries lacking NEEDED entries
- qa_var="QA_DT_NEEDED_${ARCH/-/_}"
- eval "[[ -n \${!qa_var} ]] &&
QA_DT_NEEDED=(\"\${${qa_var}[@]}\")"
- # PREFIX LOCAL: keep offset prefix in the recorded files
- f=$(scanelf -ByF '%n %p' "${ED}"{,usr/}lib*/lib*.so* | awk '$2
== "" { print }' | sed -e "s:^[[:space:]]${D}:/:")
- # END PREFIX LOCAL
- if [[ -n ${f} ]] ; then
- echo "${f}" > "${T}"/scanelf-missing-NEEDED.log
- if [[ "${QA_STRICT_DT_NEEDED-unset}" == unset ]] ; then
- if [[ ${#QA_DT_NEEDED[@]} -gt 1 ]] ; then
- for x in "${QA_DT_NEEDED[@]}" ; do
- sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-NEEDED.log
- done
- else
- local shopts=$-
- set -o noglob
- for x in ${QA_DT_NEEDED} ; do
- sed -e "s#^/${x#/}\$##" -i
"${T}"/scanelf-missing-NEEDED.log
- done
- set +o noglob
- set -${shopts}
- fi
- fi
- sed -e "/^\$/d" -i "${T}"/scanelf-missing-NEEDED.log
- f=$(<"${T}"/scanelf-missing-NEEDED.log)
- if [[ -n ${f} ]] ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: The following shared
libraries lack NEEDED entries"
- eqawarn "${f}"
- __vecho -ne '\n'
- sleep 1
- else
- rm -f "${T}"/scanelf-missing-NEEDED.log
- fi
- fi
-
- PORTAGE_QUIET=${tmp_quiet}
- fi
-
# Create NEEDED.ELF.2 regardless of RESTRICT=binchecks, since this info
is
# too useful not to have (it's required for things like preserve-libs),
and
# it's tempting for ebuild authors to set RESTRICT=binchecks for
packages
@@@ -588,829 -230,11 +269,396 @@@
eqawarn "$(while read -r x; do x=${x#*;} ; x=${x%%;*} ;
echo "${x#${EPREFIX}}" ; done < "${PORTAGE_BUILDDIR}"/build-info/NEEDED.ELF.2)"
fi
fi
+}
+install_qa_check_misc() {
- # PREFIX LOCAL: keep offset prefix in the reported files
- local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm
-4002 ')' | sed -e "s:^${D}:/:")
- # END PREFIX LOCAL
- if [[ -n ${unsafe_files} ]] ; then
- eqawarn "QA Notice: Unsafe files detected (set*id and world
writable)"
- eqawarn "${unsafe_files}"
- die "Unsafe files found in \${D}. Portage will not install
them."
- fi
-
- if [[ -d ${D%/}${D} ]] ; then
- local -i INSTALLTOD=0
- while read -r -d $'\0' i ; do
- eqawarn "QA Notice: /${i##${D%/}${D}} installed in
\${D}/\${D}"
- ((INSTALLTOD++))
- done < <(find "${D%/}${D}" -print0)
- die "Aborting due to QA concerns: ${INSTALLTOD} files installed
in ${D%/}${D}"
- fi
-
- # Sanity check syntax errors in init.d scripts
- local d
- for d in /etc/conf.d /etc/init.d ; do
- [[ -d ${ED}/${d} ]] || continue
- for i in "${ED}"/${d}/* ; do
- [[ -L ${i} ]] && continue
- # if empty conf.d/init.d dir exists (baselayout), then
i will be "/etc/conf.d/*" and not exist
- [[ ! -e ${i} ]] && continue
- if [[ ${d} == /etc/init.d && ${i} != *.sh ]] ; then
- # skip non-shell-script for bug #451386
- [[ $(head -n1 "${i}") =~
^#!.*[[:space:]/](runscript|sh)$ ]] || continue
- fi
- bash -n "${i}" || die "The init.d file has syntax
errors: ${i}"
- done
- done
-
- local checkbashisms=$(type -P checkbashisms)
- if [[ -n ${checkbashisms} ]] ; then
- for d in /etc/init.d ; do
- [[ -d ${ED}${d} ]] || continue
- for i in "${ED}${d}"/* ; do
- [[ -e ${i} ]] || continue
- [[ -L ${i} ]] && continue
- f=$("${checkbashisms}" -f "${i}" 2>&1)
- [[ $? != 0 && -n ${f} ]] || continue
- eqawarn "QA Notice: shell script appears to use
non-POSIX feature(s):"
- while read -r ;
- do eqawarn " ${REPLY}"
- done <<< "${f//${ED}}"
- done
- done
- fi
-
- # Look for leaking LDFLAGS into pkg-config files
- f=$(egrep -sH '^Libs.*-Wl,(-O[012]|--hash-style)'
"${ED}"/usr/*/pkgconfig/*.pc)
- if [[ -n ${f} ]] ; then
- eqawarn "QA Notice: pkg-config files with wrong LDFLAGS
detected:"
- eqawarn "${f//${D}}"
- fi
-
- # this should help to ensure that all (most?) shared libraries are
executable
- # and that all libtool scripts / static libraries are not executable
- local j
- for i in "${ED}"opt/*/lib* \
- "${ED}"lib* \
- "${ED}"usr/lib* ; do
- [[ ! -d ${i} ]] && continue
-
- for j in "${i}"/*.so.* "${i}"/*.so "${i}"/*.dylib "${i}"/*.dll
; do
- [[ ! -e ${j} ]] && continue
- [[ -L ${j} ]] && continue
- [[ -x ${j} ]] && continue
- __vecho "making executable: ${j#${ED}}"
- chmod +x "${j}"
- done
-
- for j in "${i}"/*.a "${i}"/*.la ; do
- [[ ! -e ${j} ]] && continue
- [[ -L ${j} ]] && continue
- [[ ! -x ${j} ]] && continue
- __vecho "removing executable bit: ${j#${ED}}"
- chmod -x "${j}"
- done
-
- for j in "${i}"/*.{a,dll,dylib,sl,so}.*
"${i}"/*.{a,dll,dylib,sl,so} ; do
- [[ ! -e ${j} ]] && continue
- [[ ! -L ${j} ]] && continue
- linkdest=$(readlink "${j}")
- if [[ ${linkdest} == /* ]] ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: Found an absolute symlink
in a library directory:"
- eqawarn " ${j#${D}} -> ${linkdest}"
- eqawarn " It should be a relative
symlink if in the same directory"
- eqawarn " or a linker script if it
crosses the /usr boundary."
- fi
- done
- done
-
- # When installing static libraries into /usr/lib and shared libraries
into
- # /lib, we have to make sure we have a linker script in /usr/lib along
side
- # the static library, or gcc will utilize the static lib when linking
:(.
- # http://bugs.gentoo.org/4411
- abort="no"
- local a s
- for a in "${ED}"usr/lib*/*.a ; do
- # PREFIX LOCAL: support MachO objects
- [[ ${CHOST} == *-darwin* ]] \
- && s=${a%.a}.dylib \
- || s=${a%.a}.so
- # END PREFIX LOCAL
- if [[ ! -e ${s} ]] ; then
- s=${s%usr/*}${s##*/usr/}
- if [[ -e ${s} ]] ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: Missing gen_usr_ldscript
for ${s##*/}"
- abort="yes"
- fi
- fi
- done
- [[ ${abort} == "yes" ]] && die "add those ldscripts"
-
- # Make sure people don't store libtool files or static libs in /lib
- # PREFIX LOCAL: on AIX, "dynamic libs" have extension .a, so don't
- # get false positives
- [[ ${CHOST} == *-aix* ]] \
- && f=$(ls "${ED}"lib*/*.la 2>/dev/null || true) \
- || f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
- # END PREFIX LOCAL
- if [[ -n ${f} ]] ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: Excessive files found in the / partition"
- eqawarn "${f}"
- __vecho -ne '\n'
- die "static archives (*.a) and libtool library files (*.la)
belong in /usr/lib*, not /lib*"
- fi
-
- # Verify that the libtool files don't contain bogus $D entries.
- local abort=no gentoo_bug=no always_overflow=no
- for a in "${ED}"usr/lib*/*.la ; do
- s=${a##*/}
- if grep -qs "${ED}" "${a}" ; then
- __vecho -ne '\n'
- eqawarn "QA Notice: ${s} appears to contain
PORTAGE_TMPDIR paths"
- abort="yes"
- fi
- done
- [[ ${abort} == "yes" ]] && die "soiled libtool library files found"
-
- # Evaluate misc gcc warnings
- if [[ -n ${PORTAGE_LOG_FILE} && -r ${PORTAGE_LOG_FILE} ]] ; then
- # In debug mode, this variable definition and corresponding
grep calls
- # will produce false positives if they're shown in the trace.
- local reset_debug=0
- if [[ ${-/x/} != $- ]] ; then
- set +x
- reset_debug=1
- fi
- local m msgs=(
- ": warning: dereferencing type-punned pointer will
break strict-aliasing rules"
- ": warning: dereferencing pointer .* does break
strict-aliasing rules"
- ": warning: implicit declaration of function"
- ": warning: incompatible implicit declaration of
built-in function"
- ": warning: is used uninitialized in this function" #
we'll ignore "may" and "might"
- ": warning: comparisons like X<=Y<=Z do not have their
mathematical meaning"
- ": warning: null argument where non-null required"
- ": warning: array subscript is below array bounds"
- ": warning: array subscript is above array bounds"
- ": warning: attempt to free a non-heap object"
- ": warning: .* called with .*bigger.* than .*
destination buffer"
- ": warning: call to .* will always overflow destination
buffer"
- ": warning: assuming pointer wraparound does not occur
when comparing"
- ": warning: hex escape sequence out of range"
- ": warning: [^ ]*-hand operand of comma .*has no effect"
- ": warning: converting to non-pointer type .* from NULL"
- ": warning: NULL used in arithmetic"
- ": warning: passing NULL to non-pointer argument"
- ": warning: the address of [^ ]* will always evaluate
as"
- ": warning: the address of [^ ]* will never be NULL"
- ": warning: too few arguments for format"
- ": warning: reference to local variable .* returned"
- ": warning: returning reference to temporary"
- ": warning: function returns address of local variable"
- ": warning: .*\\[-Wsizeof-pointer-memaccess\\]"
- ": warning: .*\\[-Waggressive-loop-optimizations\\]"
- # this may be valid code :/
- #": warning: multi-character character constant"
- # need to check these two ...
- #": warning: assuming signed overflow does not occur
when"
- #": warning: comparison with string literal results in
unspecified behav"
- # yacc/lex likes to trigger this one
- #": warning: extra tokens at end of .* directive"
- # only gcc itself triggers this ?
- #": warning: .*noreturn.* function does return"
- # these throw false positives when 0 is used instead of
NULL
- #": warning: missing sentinel in function call"
- #": warning: not enough variable arguments to fit a
sentinel"
- )
- abort="no"
- i=0
- local grep_cmd=grep
- [[ $PORTAGE_LOG_FILE = *.gz ]] && grep_cmd=zgrep
- while [[ -n ${msgs[${i}]} ]] ; do
- m=${msgs[$((i++))]}
- # force C locale to work around slow unicode locales
#160234
- f=$(LC_ALL=C $grep_cmd "${m}" "${PORTAGE_LOG_FILE}")
- if [[ -n ${f} ]] ; then
- abort="yes"
- # for now, don't make this fatal (see bug
#337031)
- #case "$m" in
- # ": warning: call to .* will always
overflow destination buffer") always_overflow=yes ;;
- #esac
- if [[ $always_overflow = yes ]] ; then
- eerror
- eerror "QA Notice: Package triggers
severe warnings which indicate that it"
- eerror " may exhibit random
runtime failures."
- eerror
- eerror "${f}"
- eerror
- eerror " Please file a bug about this
at http://bugs.gentoo.org/";
- eerror " with the maintaining herd of
the package."
- eerror
- else
- __vecho -ne '\n'
- eqawarn "QA Notice: Package triggers
severe warnings which indicate that it"
- eqawarn " may exhibit random
runtime failures."
- eqawarn "${f}"
- __vecho -ne '\n'
- fi
- fi
- done
- local cat_cmd=cat
- [[ $PORTAGE_LOG_FILE = *.gz ]] && cat_cmd=zcat
- [[ $reset_debug = 1 ]] && set -x
- # Use safe cwd, avoiding unsafe import for bug #469338.
- f=$(cd "${PORTAGE_PYM_PATH}" ; $cat_cmd "${PORTAGE_LOG_FILE}" |
\
- "${PORTAGE_PYTHON:-@PREFIX_PORTAGE_PYTHON@}"
"$PORTAGE_BIN_PATH"/check-implicit-pointer-usage.py || die
"check-implicit-pointer-usage.py failed")
- if [[ -n ${f} ]] ; then
-
- # In the future this will be a forced "die". In
preparation,
- # increase the log level from "qa" to "eerror" so that
people
- # are aware this is a problem that must be fixed asap.
-
- # just warn on 32bit hosts but bail on 64bit hosts
- case ${CHOST} in
-
alpha*|hppa64*|ia64*|powerpc64*|mips64*|sparc64*|sparcv9*|x86_64*)
gentoo_bug=yes ;;
- esac
-
- abort=yes
-
- if [[ $gentoo_bug = yes ]] ; then
- eerror
- eerror "QA Notice: Package triggers severe
warnings which indicate that it"
- eerror " will almost certainly crash
on 64bit architectures."
- eerror
- eerror "${f}"
- eerror
- eerror " Please file a bug about this at
http://bugs.gentoo.org/";
- eerror " with the maintaining herd of the
package."
- eerror
- else
- __vecho -ne '\n'
- eqawarn "QA Notice: Package triggers severe
warnings which indicate that it"
- eqawarn " will almost certainly crash
on 64bit architectures."
- eqawarn "${f}"
- __vecho -ne '\n'
- fi
-
- fi
- if [[ ${abort} == "yes" ]] ; then
- if [[ $gentoo_bug = yes || $always_overflow = yes ]] ;
then
- die "install aborted due to severe warnings
shown above"
- else
- echo "Please do not file a Gentoo bug and
instead" \
- "report the above QA issues directly to the
upstream" \
- "developers of this software." | fmt -w 70 | \
- while read -r line ; do eqawarn "${line}" ; done
- eqawarn "Homepage: ${HOMEPAGE}"
- has stricter ${FEATURES} && \
- die "install aborted due to severe
warnings shown above"
- fi
- fi
- fi
-
# Portage regenerates this on the installed system.
rm -f "${ED}"/usr/share/info/dir{,.gz,.bz2} || die "rm failed!"
-
- if has multilib-strict ${FEATURES} && \
- [[ -x ${EPREFIX}/usr/bin/file && -x ${EPREFIX}/usr/bin/find ]] && \
- [[ -n ${MULTILIB_STRICT_DIRS} && -n ${MULTILIB_STRICT_DENY} ]]
- then
- rm -f "${T}/multilib-strict.log"
- local abort=no dir file
- MULTILIB_STRICT_EXEMPT=$(echo ${MULTILIB_STRICT_EXEMPT} | sed
-e 's:\([(|)]\):\\\1:g')
- for dir in ${MULTILIB_STRICT_DIRS} ; do
- [[ -d ${ED}/${dir} ]] || continue
- for file in $(find ${ED}/${dir} -type f | grep -v
"^${ED}/${dir}/${MULTILIB_STRICT_EXEMPT}"); do
- if file ${file} | egrep -q
"${MULTILIB_STRICT_DENY}" ; then
- echo "${file#${ED}//}" >>
"${T}/multilib-strict.log"
- fi
- done
- done
-
- if [[ -s ${T}/multilib-strict.log ]] ; then
- if [[ ${#QA_MULTILIB_PATHS[@]} -eq 1 ]] ; then
- local shopts=$-
- set -o noglob
- QA_MULTILIB_PATHS=(${QA_MULTILIB_PATHS})
- set +o noglob
- set -${shopts}
- fi
- if [ "${QA_STRICT_MULTILIB_PATHS-unset}" = unset ] ;
then
- for x in "${QA_MULTILIB_PATHS[@]}" ; do
- sed -e "s#^${x#/}\$##" -i
"${T}/multilib-strict.log"
- done
- sed -e "/^\$/d" -i "${T}/multilib-strict.log"
- fi
- if [[ -s ${T}/multilib-strict.log ]] ; then
- abort=yes
- echo "Files matching a file type that is not
allowed:"
- while read -r ; do
- echo " ${REPLY}"
- done < "${T}/multilib-strict.log"
- fi
- fi
-
- [[ ${abort} == yes ]] && die "multilib-strict check failed!"
- fi
- }
-
- install_qa_check_prefix() {
- if [[ -d ${ED%/}/${D} ]] ; then
- find "${ED%/}/${D}" | \
- while read i ; do
- eqawarn "QA Notice: /${i##${ED%/}/${D}} installed in
\${ED}/\${D}"
- done
- die "Aborting due to QA concerns: files installed in ${ED}/${D}"
- fi
-
- if [[ -d ${ED%/}/${EPREFIX} ]] ; then
- find "${ED%/}/${EPREFIX}/" | \
- while read i ; do
- eqawarn "QA Notice: ${i#${D}} double prefix"
- done
- die "Aborting due to QA concerns: double prefix files installed"
- fi
-
- if [[ -d ${D} ]] ; then
- INSTALLTOD=$(find ${D%/} | egrep -v "^${ED}" | sed -e
"s|^${D%/}||" | awk '{if (length($0) <= length("'"${EPREFIX}"'")) { if
(substr("'"${EPREFIX}"'", 1, length($0)) != $0) {print $0;} } else if
(substr($0, 1, length("'"${EPREFIX}"'")) != "'"${EPREFIX}"'") {print $0;} }')
- if [[ -n ${INSTALLTOD} ]] ; then
- eqawarn "QA Notice: the following files are outside of
the prefix:"
- eqawarn "${INSTALLTOD}"
- die "Aborting due to QA concerns: there are files
installed outside the prefix"
- fi
- fi
-
- # all further checks rely on ${ED} existing
- [[ -d ${ED} ]] || return
-
- # check shebangs, bug #282539
- rm -f "${T}"/non-prefix-shebangs-errs
- local WHITELIST=" /usr/bin/env "
- # this is hell expensive, but how else?
- find "${ED}" -executable \! -type d -print0 \
- | xargs -0 grep -H -n -m1 "^#!" \
- | while read f ;
- do
- local fn=${f%%:*}
- local pos=${f#*:} ; pos=${pos%:*}
- local line=${f##*:}
- # shebang always appears on the first line ;)
- [[ ${pos} != 1 ]] && continue
- local oldIFS=${IFS}
- IFS=$'\r'$'\n'$'\t'" "
- line=( ${line#"#!"} )
- IFS=${oldIFS}
- [[ ${WHITELIST} == *" ${line[0]} "* ]] && continue
- local fp=${fn#${D}} ; fp=/${fp%/*}
- # line[0] can be an absolutised path, bug #342929
- local eprefix=$(canonicalize ${EPREFIX})
- local rf=${fn}
- # in case we deal with a symlink, make sure we don't replace it
- # with a real file (sed -i does that)
- if [[ -L ${fn} ]] ; then
- rf=$(readlink ${fn})
- [[ ${rf} != /* ]] && rf=${fn%/*}/${rf}
- # ignore symlinks pointing to outside prefix
- # as seen in sys-devel/native-cctools
- [[ $(canonicalize "/${rf#${D}}") != ${eprefix}/* ]] &&
continue
- fi
- # does the shebang start with ${EPREFIX}, and does it exist?
- if [[ ${line[0]} == ${EPREFIX}/* || ${line[0]} == ${eprefix}/*
]] ; then
- if [[ ! -e ${ROOT%/}${line[0]} && ! -e ${D%/}${line[0]}
]] ; then
- # hmm, refers explicitly to $EPREFIX, but
doesn't exist,
- # if it's in PATH that's wrong in any case
- if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
- echo "${fn#${D}}:${line[0]} (explicit
EPREFIX but target not found)" \
- >>
"${T}"/non-prefix-shebangs-errs
- else
- eqawarn "${fn#${D}} has explicit
EPREFIX in shebang but target not found (${line[0]})"
- fi
- fi
- continue
- fi
- # unprefixed shebang, is the script directly in $PATH or an init
- # script?
- if [[ ":${PATH}:${EPREFIX}/etc/init.d:" == *":${fp}:"* ]] ; then
- if [[ -e ${EROOT}${line[0]} || -e ${ED}${line[0]} ]] ;
then
- # is it unprefixed, but we can just fix it
because a
- # prefixed variant exists
- eqawarn "prefixing shebang of ${fn#${D}}"
- # statement is made idempotent on purpose,
because
- # symlinks may point to the same target, and
hence the
- # same real file may be sedded multiple times
since we
- # read the shebangs in one go upfront for
performance
- # reasons
- sed -i -e '1s:^#!
\?'"${line[0]}"':#!'"${EPREFIX}"${line[0]}':' "${rf}"
- continue
- else
- # this is definitely wrong: script in $PATH and
invalid shebang
- echo "${fn#${D}}:${line[0]} (script ${fn##*/}
installed in PATH but interpreter ${line[0]} not found)" \
- >> "${T}"/non-prefix-shebangs-errs
- fi
- else
- # unprefixed/invalid shebang, but outside $PATH, this
may be
- # intended (e.g. config.guess) so remain silent by
default
- has stricter ${FEATURES} && \
- eqawarn "invalid shebang in ${fn#${D}}:
${line[0]}"
- fi
- done
- if [[ -e "${T}"/non-prefix-shebangs-errs ]] ; then
- eqawarn "QA Notice: the following files use invalid (possible
non-prefixed) shebangs:"
- while read line ; do
- eqawarn " ${line}"
- done < "${T}"/non-prefix-shebangs-errs
- rm -f "${T}"/non-prefix-shebangs-errs
- die "Aborting due to QA concerns: invalid shebangs found"
- fi
}
+install_qa_check_macho() {
+ if ! has binchecks ${RESTRICT} ; then
+ # on Darwin, dynamic libraries are called .dylibs instead of
+ # .sos. In addition the version component is before the
+ # extension, not after it. Check for this, and *only* warn
+ # about it. Some packages do ship .so files on Darwin and make
+ # it work (ugly!).
+ rm -f "${T}/mach-o.check"
+ find ${ED%/} -name "*.so" -or -name "*.so.*" | \
+ while read i ; do
+ [[ $(file $i) == *"Mach-O"* ]] && \
+ echo "${i#${D}}" >> "${T}/mach-o.check"
+ done
+ if [[ -f ${T}/mach-o.check ]] ; then
+ f=$(< "${T}/mach-o.check")
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: Found .so dynamic libraries on
Darwin:"
+ eqawarn " ${f//$'\n'/\n }"
+ fi
+ rm -f "${T}/mach-o.check"
+
+ # The naming for dynamic libraries is different on Darwin; the
+ # version component is before the extention, instead of after
+ # it, as with .sos. Again, make this a warning only.
+ rm -f "${T}/mach-o.check"
+ find ${ED%/} -name "*.dylib.*" | \
+ while read i ; do
+ echo "${i#${D}}" >> "${T}/mach-o.check"
+ done
+ if [[ -f "${T}/mach-o.check" ]] ; then
+ f=$(< "${T}/mach-o.check")
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: Found wrongly named dynamic
libraries on Darwin:"
+ eqawarn " ${f// /\n }"
+ fi
+ rm -f "${T}/mach-o.check"
+ fi
+
+ install_name_is_relative() {
+ case $1 in
+ "@executable_path/"*) return 0 ;;
+ "@loader_path"/*) return 0 ;;
+ "@rpath/"*) return 0 ;;
+ *) return 1 ;;
+ esac
+ }
+
+ # While we generate the NEEDED files, check that we don't get kernel
+ # traps at runtime because of broken install_names on Darwin.
+ rm -f "${T}"/.install_name_check_failed
+ scanmacho -qyRF '%a;%p;%S;%n' "${D}" | { while IFS= read l ; do
+ arch=${l%%;*}; l=${l#*;}
+ obj="/${l%%;*}"; l=${l#*;}
+ install_name=${l%%;*}; l=${l#*;}
+ needed=${l%%;*}; l=${l#*;}
+
+ ignore=
+ qa_var="QA_IGNORE_INSTALL_NAME_FILES_${ARCH/-/_}"
+ eval "[[ -n \${!qa_var} ]] &&
+ QA_IGNORE_INSTALL_NAME_FILES=(\"\${${qa_var}[@]}\")"
+
+ if [[ ${#QA_IGNORE_INSTALL_NAME_FILES[@]} -gt 1 ]] ; then
+ for x in "${QA_IGNORE_INSTALL_NAME_FILES[@]}" ; do
+ [[ ${obj##*/} == ${x} ]] && \
+ ignore=true
+ done
+ else
+ local shopts=$-
+ set -o noglob
+ for x in ${QA_IGNORE_INSTALL_NAME_FILES} ; do
+ [[ ${obj##*/} == ${x} ]] && \
+ ignore=true
+ done
+ set +o noglob
+ set -${shopts}
+ fi
+
+ # See if the self-reference install_name points to an existing
+ # and to be installed file. This usually is a symlink for the
+ # major version.
+ if install_name_is_relative ${install_name} ; then
+ # try to locate the library in the installed image
+ local inpath=${install_name#@*/}
+ local libl
+ for libl in $(find "${ED}" -name "${inpath##*/}") ; do
+ if [[ ${libl} == */${inpath} ]] ; then
+ install_name=/${libl#${D}}
+ break
+ fi
+ done
+ fi
+ if [[ ! -e ${D}${install_name} ]] ; then
+ eqawarn "QA Notice: invalid self-reference install_name
${install_name} in ${obj}"
+ # remember we are in an implicit subshell, that's
+ # why we touch a file here ... ideally we should be
+ # able to die correctly/nicely here
+ [[ -z ${ignore} && touch
"${T}"/.install_name_check_failed
+ fi
+
+ # this is ugly, paths with spaces won't work
+ for lib in ${needed//,/ } ; do
+ if [[ ${lib} == ${D}* ]] ; then
+ eqawarn "QA Notice: install_name references
\${D}: ${lib} in ${obj}"
+ [[ -z ${ignore} && touch
"${T}"/.install_name_check_failed
+ elif [[ ${lib} == ${S}* ]] ; then
+ eqawarn "QA Notice: install_name references
\${S}: ${lib} in ${obj}"
+ [[ -z ${ignore} && touch
"${T}"/.install_name_check_failed
+ elif ! install_name_is_relative ${lib} && [[ ! -e
${lib} && ! -e ${D}${lib} ]] ; then
+ eqawarn "QA Notice: invalid reference to ${lib}
in ${obj}"
+ [[ -z ${ignore} && touch
"${T}"/.install_name_check_failed
+ fi
+ done
+
+ # backwards compatibility
+ echo "${obj} ${needed}" >>
"${PORTAGE_BUILDDIR}"/build-info/NEEDED
+ # what we use
+ echo "${arch};${obj};${install_name};${needed}" >>
"${PORTAGE_BUILDDIR}"/build-info/NEEDED.MACHO.3
+ done }
+ if [[ -f ${T}/.install_name_check_failed ]] ; then
+ # secret switch "allow_broken_install_names" to get
+ # around this and install broken crap (not a good idea)
+ has allow_broken_install_names ${FEATURES} || \
+ die "invalid install_name found, your application or
library will crash at runtime"
+ fi
+}
+
+install_qa_check_pecoff() {
+ local _pfx_scan="readpecoff ${CHOST}"
+
+ # this one uses readpecoff, which supports multiple prefix platforms!
+ # this is absolutely _not_ optimized for speed, and there may be plenty
+ # of possibilities by introducing one or the other cache!
+ if ! has binchecks ${RESTRICT}; then
+ # copied and adapted from the above scanelf code.
+ local qa_var insecure_rpath=0 tmp_quiet=${PORTAGE_QUIET}
+ local f x
+
+ # display warnings when using stricter because we die afterwards
+ if has stricter ${FEATURES} ; then
+ unset PORTAGE_QUIET
+ fi
+
+ local _exec_find_opt="-executable"
+ [[ ${CHOST} == *-winnt* ]] && _exec_find_opt='-name *.dll -o
-name *.exe'
+
+ # Make sure we disallow insecure RUNPATH/RPATH's
+ # Don't want paths that point to the tree where the package was
built
+ # (older, broken libtools would do this). Also check for null
paths
+ # because the loader will search $PWD when it finds null paths.
+
+ f=$(
+ find "${ED}" -type f '(' ${_exec_find_opt} ')' -print0
| xargs -0 ${_pfx_scan} | \
+ while IFS=";" read arch obj soname rpath needed ; do \
+ echo "${rpath}" | grep -E "(${PORTAGE_BUILDDIR}|:
|::|^:|^ )" > /dev/null 2>&1 \
+ && echo "${obj}"; done;
+ )
+ # Reject set*id binaries with $ORIGIN in RPATH #260331
+ x=$(
+ find "${ED}" -type f '(' -perm -u+s -o -perm -g+s ')'
-print0 | \
+ xargs -0 ${_pfx_scan} | while IFS=";" read arch obj
soname rpath needed; do \
+ echo "${rpath}" | grep '$ORIGIN' > /dev/null 2>&1 &&
echo "${obj}"; done;
+ )
+ if [[ -n ${f}${x} ]] ; then
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: The following files contain
insecure RUNPATH's"
+ eqawarn " Please file a bug about this at
http://bugs.gentoo.org/";
+ eqawarn " with the maintaining herd of the package."
+ eqawarn "${f}${f:+${x:+\n}}${x}"
+ vecho -ne '\a\n'
+ if [[ -n ${x} ]] || has stricter ${FEATURES} ; then
+ insecure_rpath=1
+ else
+ eqawarn "cannot automatically fix runpaths on
interix platforms!"
+ fi
+ fi
+
+ rm -f "${PORTAGE_BUILDDIR}"/build-info/NEEDED
+ rm -f "${PORTAGE_BUILDDIR}"/build-info/NEEDED.PECOFF.1
+
+ # Save NEEDED information after removing self-contained
providers
+ find "${ED}" -type f '(' ${_exec_find_opt} ')' -print0 | xargs
-0 ${_pfx_scan} | { while IFS=';' read arch obj soname rpath needed; do
+ # need to strip image dir from object name.
+ obj="/${obj#${D}}"
+ if [ -z "${rpath}" -o -n "${rpath//*ORIGIN*}" ]; then
+ # object doesn't contain $ORIGIN in its runpath
attribute
+ echo "${obj} ${needed}" >>
"${PORTAGE_BUILDDIR}"/build-info/NEEDED
+ echo
"${arch};${obj};${soname};${rpath};${needed}" >>
"${PORTAGE_BUILDDIR}"/build-info/NEEDED.PECOFF.1
+ else
+ dir=${obj%/*}
+ # replace $ORIGIN with the dirname of the
current object for the lookup
+ opath=$(echo :${rpath}: | sed -e
"s#.*:\(.*\)\$ORIGIN\(.*\):.*#\1${dir}\2#")
+ sneeded=$(echo ${needed} | tr , ' ')
+ rneeded=""
+ for lib in ${sneeded}; do
+ found=0
+ for path in ${opath//:/ }; do
+ [ -e "${ED}/${path}/${lib}" ]
&& found=1 && break
+ done
+ [ "${found}" -eq 0 ] &&
rneeded="${rneeded},${lib}"
+ done
+ rneeded=${rneeded:1}
+ if [ -n "${rneeded}" ]; then
+ echo "${obj} ${rneeded}" >>
"${PORTAGE_BUILDDIR}"/build-info/NEEDED
+ echo
"${arch};${obj};${soname};${rpath};${rneeded}" >>
"${PORTAGE_BUILDDIR}"/build-info/NEEDED.PECOFF.1
+ fi
+ fi
+ done }
+
+ if [[ ${insecure_rpath} -eq 1 ]] ; then
+ die "Aborting due to serious QA concerns with
RUNPATH/RPATH"
+ elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
+ die "Aborting due to QA concerns: ${die_msg}"
+ fi
+
+ local _so_ext='.so*'
+
+ case "${CHOST}" in
+ *-winnt*) _so_ext=".dll" ;; # no "*" intentionally!
+ esac
+
+ # Run some sanity checks on shared libraries
+ for d in "${ED}"lib* "${ED}"usr/lib* ; do
+ [[ -d "${d}" ]] || continue
+ f=$(find "${d}" -name "lib*${_so_ext}" -print0 | \
+ xargs -0 ${_pfx_scan} | while IFS=";" read arch
obj soname rpath needed; \
+ do [[ -z "${soname}" ]] && echo "${obj}"; done)
+ if [[ -n ${f} ]] ; then
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: The following shared
libraries lack a SONAME"
+ eqawarn "${f}"
+ vecho -ne '\a\n'
+ sleep 1
+ fi
+
+ f=$(find "${d}" -name "lib*${_so_ext}" -print0 | \
+ xargs -0 ${_pfx_scan} | while IFS=";" read arch
obj soname rpath needed; \
+ do [[ -z "${needed}" ]] && echo "${obj}"; done)
+ if [[ -n ${f} ]] ; then
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: The following shared
libraries lack NEEDED entries"
+ eqawarn "${f}"
+ vecho -ne '\a\n'
+ sleep 1
+ fi
+ done
+
+ PORTAGE_QUIET=${tmp_quiet}
+ fi
+}
+
+install_qa_check_xcoff() {
+ if ! has binchecks ${RESTRICT}; then
+ local tmp_quiet=${PORTAGE_QUIET}
+ local queryline deplib
+ local insecure_rpath_list= undefined_symbols_list=
+
+ # display warnings when using stricter because we die afterwards
+ if has stricter ${FEATURES} ; then
+ unset PORTAGE_QUIET
+ fi
+
+ rm -f "${PORTAGE_BUILDDIR}"/build-info/NEEDED.XCOFF.1
+
+ local neededfd
+ for neededfd in {3..1024} none; do ( : <&${neededfd} )
2>/dev/null || break; done
+ [[ ${neededfd} != none ]] || die "cannot find free file
descriptor handle"
+
+ eval "exec
${neededfd}>\"${PORTAGE_BUILDDIR}\"/build-info/NEEDED.XCOFF.1" || die "cannot
open ${PORTAGE_BUILDDIR}/build-info/NEEDED.XCOFF.1"
+
+ ( # work around a problem in /usr/bin/dump (used by
aixdll-query)
+ # dumping core when path names get too long.
+ cd "${ED}" >/dev/null &&
+ find . -not -type d -exec \
+ aixdll-query '{}' FILE MEMBER FLAGS FORMAT
RUNPATH DEPLIBS ';'
+ ) > "${T}"/needed 2>/dev/null
+
+ # Symlinking shared archive libraries is not a good idea on aix,
+ # as there is nothing like "soname" on pure filesystem level.
+ # So we create a copy instead of the symlink.
+ local prev_FILE=
+ local FILE MEMBER FLAGS FORMAT RUNPATH DEPLIBS
+ while read queryline
+ do
+ FILE= MEMBER= FLAGS= FORMAT= RUNPATH= DEPLIBS=
+ eval ${queryline}
+ FILE=${FILE#./}
+
+ if [[ ${prev_FILE} != ${FILE} ]]; then
+ if [[ " ${FLAGS} " == *" SHROBJ "* && -h
${ED}${FILE} ]]; then
+ prev_FILE=${FILE}
+ local target=$(readlink "${ED}${FILE}")
+ if [[ ${target} == /* ]]; then
+ target=${D}${target}
+ else
+ target=${FILE%/*}/${target}
+ fi
+ rm -f "${ED}${FILE}" || die "cannot
prune ${FILE}"
+ cp -f "${ED}${target}" "${ED}${FILE}"
|| die "cannot copy ${target} to ${FILE}"
+ fi
+ fi
+ done <"${T}"/needed
+
+ prev_FILE=
+ while read queryline
+ do
+ FILE= MEMBER= FLAGS= FORMAT= RUNPATH= DEPLIBS=
+ eval ${queryline}
+ FILE=${FILE#./}
+
+ if [[ -n ${MEMBER} && ${prev_FILE} != ${FILE} ]]; then
+ # Save NEEDED information for each archive
library stub
+ # even if it is static only: the already
installed archive
+ # may contain shared objects to be preserved.
+ echo "${FORMAT##*
}${FORMAT%%-*};${EPREFIX}/${FILE};${FILE##*/};;" >&${neededfd}
+ fi
+ prev_FILE=${FILE}
+
+ # shared objects have both EXEC and SHROBJ flags,
+ # while executables have EXEC flag only.
+ [[ " ${FLAGS} " == *" EXEC "* ]] || continue
+
+ # Make sure we disallow insecure RUNPATH's
+ # Don't want paths that point to the tree where the
package was built
+ # (older, broken libtools would do this). Also check
for null paths
+ # because the loader will search $PWD when it finds
null paths.
+ # And we really want absolute paths only.
+ if [[ -n $(echo ":${RUNPATH}:" | grep -E
"(${PORTAGE_BUILDDIR}|::|:[^/])") ]]; then
+
insecure_rpath_list="${insecure_rpath_list}\n${FILE}${MEMBER:+[${MEMBER}]}"
+ fi
+
+ local needed=
+ [[ -n ${MEMBER} ]] && needed=${FILE##*/}
+ for deplib in ${DEPLIBS}; do
+ eval deplib=${deplib}
+ if [[ ${deplib} == '.' || ${deplib} == '..' ]];
then
+ # Although we do have runtime linking,
we don't want undefined symbols.
+ # AIX does indicate this by needing
either '.' or '..'
+
undefined_symbols_list="${undefined_symbols_list}\n${FILE}"
+ else
+ needed="${needed}${needed:+,}${deplib}"
+ fi
+ done
+
+ FILE=${EPREFIX}/${FILE}
+
+ [[ -n ${MEMBER} ]] && MEMBER="[${MEMBER}]"
+ # Save NEEDED information
+ echo "${FORMAT##*
}${FORMAT%%-*};${FILE}${MEMBER};${FILE##*/}${MEMBER};${RUNPATH};${needed}"
>&${neededfd}
+ done <"${T}"/needed
+
+ eval "exec ${neededfd}>&-" || die "cannot close handle to
${PORTAGE_BUILDDIR}/build-info/NEEDED.XCOFF.1"
+
+ if [[ -n ${undefined_symbols_list} ]]; then
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: The following files contain
undefined symbols."
+ eqawarn " Please file a bug about this at
http://bugs.gentoo.org/";
+ eqawarn " with 'prefix' as the maintaining herd of the
package."
+ eqawarn "${undefined_symbols_list}"
+ vecho -ne '\a\n'
+ fi
+
+ if [[ -n ${insecure_rpath_list} ]] ; then
+ vecho -ne '\a\n'
+ eqawarn "QA Notice: The following files contain
insecure RUNPATH's"
+ eqawarn " Please file a bug about this at
http://bugs.gentoo.org/";
+ eqawarn " with 'prefix' as the maintaining herd of the
package."
+ eqawarn "${insecure_rpath_list}"
+ vecho -ne '\a\n'
+ if has stricter ${FEATURES} ; then
+ insecure_rpath=1
+ fi
+ fi
+
+ if [[ ${insecure_rpath} -eq 1 ]] ; then
+ die "Aborting due to serious QA concerns with
RUNPATH/RPATH"
+ elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
+ die "Aborting due to QA concerns: ${die_msg}"
+ fi
+
+ PORTAGE_QUIET=${tmp_quiet}
+ fi
+}
+
install_mask() {
local root="$1"
shift
diff --cc bin/portageq
index ea9dfde,009f116..7b9e177
--- a/bin/portageq
+++ b/bin/portageq
@@@ -23,22 -23,22 +23,22 @@@ except KeyboardInterrupt
import os
import types
-if
os.path.isfile(os.path.join(os.path.dirname(os.path.dirname(os.path.realpath(__file__))),
".portage_not_installed")):
- pym_paths =
[os.path.join(os.path.dirname(os.path.dirname(os.path.realpath(__file__))),
"pym")]
- sys.path.insert(0, pym_paths[0])
+# for an explanation on this logic, see pym/_emerge/__init__.py
+if os.environ.__contains__("PORTAGE_PYTHONPATH"):
+ pym_path = os.environ["PORTAGE_PYTHONPATH"]
else:
- import distutils.sysconfig
- pym_paths = [os.path.join(distutils.sysconfig.get_python_lib(), x) for
x in ("_emerge", "portage")]
+ pym_path = os.path.join(os.path.dirname(
+ os.path.dirname(os.path.realpath(__file__))), "pym")
- # Avoid sandbox violations after python upgrade.
+ # Avoid sandbox violations after Python upgrade.
if os.environ.get("SANDBOX_ON") == "1":
sandbox_write = os.environ.get("SANDBOX_WRITE", "").split(":")
- if pym_path not in sandbox_write:
- sandbox_write.append(pym_path)
- os.environ["SANDBOX_WRITE"] = \
- ":".join(filter(None, sandbox_write))
- del sandbox_write
+ for pym_path in pym_paths:
+ if pym_path not in sandbox_write:
+ sandbox_write.append(pym_path)
+ os.environ["SANDBOX_WRITE"] = ":".join(filter(None,
sandbox_write))
+ del pym_path, sandbox_write
+ del pym_paths
- sys.path.insert(0, pym_path)
import portage
portage._internal_caller = True
from portage import os
diff --cc pym/portage/const.py
index 89d7ee2,acb90f9..5f00fab
--- a/pym/portage/const.py
+++ b/pym/portage/const.py
@@@ -65,35 -58,23 +65,36 @@@ DEPCACHE_PATH = "/var/cache/
GLOBAL_CONFIG_PATH = "/usr/share/portage/config"
# these variables are not used with target_root or config_root
+PORTAGE_BASE_PATH = PORTAGE_BASE
# NOTE: Use realpath(__file__) so that python module symlinks in site-packages
# are followed back to the real location of the whole portage installation.
+#PREFIX: below should work, but I'm not sure how it it affects other places
- #PORTAGE_BASE_PATH = os.path.join(os.sep, os.sep.join(os.path.realpath(
- # __file__.rstrip("co")).split(os.sep)[:-3]))
+ # NOTE: Please keep PORTAGE_BASE_PATH in one line to help substitutions.
-PORTAGE_BASE_PATH = os.path.join(os.sep,
os.sep.join(os.path.realpath(__file__.rstrip("co")).split(os.sep)[:-3]))
++#PORTAGE_BASE_PATH = os.path.join(os.sep,
os.sep.join(os.path.realpath(__file__.rstrip("co")).split(os.sep)[:-3]))
PORTAGE_BIN_PATH = PORTAGE_BASE_PATH + "/bin"
- PORTAGE_PYM_PATH = PORTAGE_BASE_PATH + "/pym"
+ PORTAGE_PYM_PATH = os.path.realpath(os.path.join(__file__, '../..'))
LOCALE_DATA_PATH = PORTAGE_BASE_PATH + "/locale" # FIXME: not used
EBUILD_SH_BINARY = PORTAGE_BIN_PATH + "/ebuild.sh"
MISC_SH_BINARY = PORTAGE_BIN_PATH + "/misc-functions.sh"
-SANDBOX_BINARY = "/usr/bin/sandbox"
-FAKEROOT_BINARY = "/usr/bin/fakeroot"
-BASH_BINARY = "/bin/bash"
-MOVE_BINARY = "/bin/mv"
+SANDBOX_BINARY = EPREFIX + "/usr/bin/sandbox"
+FAKEROOT_BINARY = EPREFIX + "/usr/bin/fakeroot"
+BASH_BINARY = PORTAGE_BASH
+MOVE_BINARY = PORTAGE_MV
PRELINK_BINARY = "/usr/sbin/prelink"
+MACOSSANDBOX_BINARY = "/usr/bin/sandbox-exec"
+MACOSSANDBOX_PROFILE = '''(version 1)
+(allow default)
+(deny file-write*)
+(allow file-write*
+@@MACOSSANDBOX_PATHS@@)
+(allow file-write-data
+@@MACOSSANDBOX_PATHS_CONTENT_ONLY@@)'''
+
+PORTAGE_GROUPNAME = portagegroup
+PORTAGE_USERNAME = portageuser
INVALID_ENV_FILE = "/etc/spork/is/not/valid/profile.env"
+ MERGING_IDENTIFIER = "-MERGING-"
REPO_NAME_FILE = "repo_name"
REPO_NAME_LOC = "profiles" + "/" + REPO_NAME_FILE
diff --cc pym/portage/dbapi/vartree.py
index 040b546,b46ba0b..deeb779
--- a/pym/portage/dbapi/vartree.py
+++ b/pym/portage/dbapi/vartree.py
@@@ -48,7 -46,7 +49,7 @@@ portage.proxy.lazyimport.lazyimport(glo
)
from portage.const import CACHE_PATH, CONFIG_MEMORY_FILE, \
- PORTAGE_PACKAGE_ATOM, PRIVATE_PATH, VDB_PATH, EPREFIX, EPREFIX_LSTRIP,
BASH_BINARY
- MERGING_IDENTIFIER, PORTAGE_PACKAGE_ATOM, PRIVATE_PATH, VDB_PATH
++ MERGING_IDENTIFIER, PORTAGE_PACKAGE_ATOM, PRIVATE_PATH, VDB_PATH,
EPREFIX, EPREFIX_LSTRIP, BASH_BINARY
from portage.dbapi import dbapi
from portage.exception import CommandNotFound, \
InvalidData, InvalidLocation, InvalidPackageName, \
diff --cc pym/portage/package/ebuild/config.py
index fb4956d,264ed8e..6e578a9
--- a/pym/portage/package/ebuild/config.py
+++ b/pym/portage/package/ebuild/config.py
@@@ -37,10 -37,11 +37,11 @@@ from portage.dep import Atom, isvalidat
from portage.eapi import eapi_exports_AA, eapi_exports_merge_type, \
eapi_supports_prefix, eapi_exports_replace_vars, _get_eapi_attrs
from portage.env.loaders import KeyValuePairFileLoader
- from portage.exception import InvalidDependString, PortageException
+ from portage.exception import InvalidDependString, IsADirectory, \
+ PortageException
from portage.localization import _
from portage.output import colorize
-from portage.process import fakeroot_capable, sandbox_capable
+from portage.process import fakeroot_capable, sandbox_capable,
macossandbox_capable
from portage.repository.config import load_repository_config
from portage.util import ensure_dirs, getconfig, grabdict, \
grabdict_package, grabfile, grabfile_package, LazyItemsDict, \
diff --cc pym/portage/package/ebuild/doebuild.py
index 3c2167a,d3e3f5a..8e55fe2
--- a/pym/portage/package/ebuild/doebuild.py
+++ b/pym/portage/package/ebuild/doebuild.py
@@@ -46,8 -45,7 +46,7 @@@ from portage import auxdbkeys, bsd_chfl
unmerge, _encodings, _os_merge, \
_shell_quote, _unicode_decode, _unicode_encode
from portage.const import EBUILD_SH_ENV_FILE, EBUILD_SH_ENV_DIR, \
- EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY, \
- EPREFIX, MACOSSANDBOX_PROFILE
- EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY, PORTAGE_PYM_PACKAGES
++ EBUILD_SH_BINARY, INVALID_ENV_FILE, MISC_SH_BINARY,
PORTAGE_PYM_PACKAGES, EPREFIX, MACOSSANDBOX_PROFILE
from portage.data import portage_gid, portage_uid, secpass, \
uid, userpriv_groups
from portage.dbapi.porttree import _parse_uri_map
