PR#49: Don't build-require files outside of permitted directories - rpms/gcc

rpms / gcc

#49 Don't build-require files outside of permitted directories

Closed 4 months ago by praiskup. Opened 4 months ago by praiskup.

rpms/ praiskup/gcc no-file-lists-f40 into rawhide

Don't build-require files outside of permitted directories

Pavel Raiskup • 4 months ago

a87db37

gcc.spec

file modified

		`@@ -208,10 +208,16 @@`
		`# Make sure glibc supports TFmode long double`
		`BuildRequires: glibc >= 2.3.90-35`
		`%endif`
		`+ %ifarch x86_64`
		`+ # Koji 64-bit buildroots do not contain packages from 32-bit builds, therefore`
		`+ # the 'glibc-devel.i686' variant is provided as 'glibc32'.`
		`+ BuildRequires: (glibc32 or glibc-devel(%__isa_name-32))`
		`+ %else`
		`%ifarch %{multilib_64_archs} sparcv9 ppc`
		`# Ensure glibc{,-devel} is installed for both multilib arches`
		`BuildRequires: /lib/libc.so.6 /usr/lib/libc.so /lib64/libc.so.6 /usr/lib64/libc.so`
		`%endif`
		`+ %endif`
		`%if %{build_ada}`
		`# Ada requires Ada to build`
		`BuildRequires: gcc-gnat >= 3.1, libgnat >= 3.1`

praiskup commented 4 months ago

Packaging guidelines only allow dependencies on files in /usr/bin,
/usr/sbin and /etc.

Guidelines: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies
Relates: https://fedoraproject.org/wiki/Changes/BuildWithDNF5
Relates: https://fedoraproject.org/wiki/Changes/ReplaceDnfWithDnf5

rebased onto e7e918cb24f2d9deaa0084f553a02969bb728b73

4 months ago

fweimer commented 4 months ago

This doesn't work, the file dependencies were there for a reason:

DEBUG util.py:461:  No match for argument: glibc(x86-32)
DEBUG util.py:461:  No match for argument: glibc-devel(x86-32)

You could try:

BuildRequires: (glibc32 or glibc-devel(x86-32))

And please make the whole block conditional on x86_64, we have no way to test this on the other architectures.

praiskup commented 4 months ago

Hmmm, what am I missing?

<mock-chroot> sh-5.2# rpm -q --provides glibc-devel | grep 32
glibc-devel(x86-32) = 2.38.9000-33.fc40

praiskup commented 4 months ago

we have no way to test this on the other architectures

I actually tested that the %__isa_name expands correctly on other multilib architectures:
https://pagure.io/releng/issue/11888#comment-891976

fweimer commented 4 months ago

i686 packages are not available in the x86_64 buildroot, which is why we are using glibc32 as manual workaround. The file-based BuildRequires: was written so that it can be fulfilled by both packages.

fweimer commented 4 months ago

we have no way to test this on the other architectures

I actually tested that the %__isa_name expands correctly on other multilib architectures:
https://pagure.io/releng/issue/11888#comment-891976

I was referencing the current list of architectures (%ifarch %{multilib_64_archs} sparcv9 ppc). Of those, you have only tested this on x86_64.

rebased onto 6720a82913d567cee21d77b984a62de56e93f162

4 months ago

praiskup commented 4 months ago

I tested with a non-conditional BuildRequires: glibc-devel(%__isa_name-32) statement
and built for ppc64 chroot (using qemu emulation, locally). This ended up with with
No match for argument: glibc(ppc-32) error. But as I learned now, this might not be
a good enough test anyway.