Wednesday, September 26, 2018

Re: update: lang/rust 1.29.1 (security)

On Tue, Sep 25, 2018 at 04:53:54PM +0100, Stuart Henderson wrote:
> >
> > A possible way could be:
> > - having a sub-package -libstd on lang/rust (which would be empty or almost)
> > - add RUN_DEPENDS+=lang/rust,-libstd to port using rustc
> >
> > when lang/rust is updated, the subpackage rust-libstd will automatically
> > crank, and so the signature of packages with RUN_DEPENDS will change,
> > and pkg_add -u will update. Does it make sens ? The drawback would be to
> > manually maintain the RUN_DEPENDS, but it is low overhead and one-time
> > only.
>
> This would work, it feels a little 'dirty' but not too bad. There's a
> similar problem in lang/go fwiw. If this is done via RUN_DEPENDS,
> then PKGSPEC can be used to force updates when needed, without having
> to bump dependent ports.
>
> But for the immediate case, just bumping them makes sense for now,
> I don't think we'll have time for anything more complex.
>

The following diff tries to implement it.

Several parts:
- new subpackage lang/rust,-staticlib (with empty PLIST)

- module devel/cargo will add (by default, but it is overridable)
RUN_DEPENDS += lang/rust,-staticlib

- for ports not using the module add an explicit RUN_DEPENDS

- every impacted port (directly by RUN_DEPENDS addition or indirectly
by devel/cargo usage) is bumped

I did a quick test with ripgrep. When I modify lang/rust version (with
REVISION++), the packaging of ripgrep seems to correctly incoporate the
change:

===> Building package for ripgrep-0.8.1p2
Create /home/semarie/repos/openbsd/ports/packages/amd64/all/ripgrep-0.8.1p2.tgz
Creating package ripgrep-0.8.1p2
/home/semarie/repos/openbsd/ports/plist/amd64/ripgrep-0.8.1p2 was updated
lang/rust,-staticlib:rust-staticlib-*:rust-staticlib-1.29.1p0 -> lang/rust,-staticlib:rust-staticlib-*:rust-staticlib-1.29.1p1
Link to /home/semarie/repos/openbsd/ports/packages/amd64/ftp/ripgrep-0.8.1p2.tgz
Link to /home/semarie/repos/openbsd/ports/packages/amd64/cdrom/ripgrep-0.8.1p2.tgz

Thanks
--
Sebastien Marie


Index: devel/cbindgen/Makefile
===================================================================
RCS file: /cvs/ports/devel/cbindgen/Makefile,v
retrieving revision 1.4
diff -u -p -r1.4 Makefile
--- devel/cbindgen/Makefile 25 Sep 2018 21:16:37 -0000 1.4
+++ devel/cbindgen/Makefile 26 Sep 2018 12:00:37 -0000
@@ -5,7 +5,7 @@ COMMENT = C bindings generator from rus
GH_ACCOUNT = eqrion
GH_PROJECT = cbindgen
GH_TAGNAME = v0.6.3
-REVISION = 0
+REVISION = 1

CATEGORIES = devel

Index: textproc/ripgrep/Makefile
===================================================================
RCS file: /cvs/ports/textproc/ripgrep/Makefile,v
retrieving revision 1.10
diff -u -p -r1.10 Makefile
--- textproc/ripgrep/Makefile 25 Sep 2018 21:16:37 -0000 1.10
+++ textproc/ripgrep/Makefile 26 Sep 2018 12:00:41 -0000
@@ -5,7 +5,7 @@ COMMENT = line oriented search tool usi
GH_ACCOUNT = BurntSushi
GH_PROJECT = ripgrep
GH_TAGNAME = 0.8.1
-REVISION = 1
+REVISION = 2

CATEGORIES = textproc sysutils

Index: www/firefox-esr/Makefile
===================================================================
RCS file: /cvs/ports/www/firefox-esr/Makefile,v
retrieving revision 1.82
diff -u -p -r1.82 Makefile
--- www/firefox-esr/Makefile 25 Sep 2018 21:16:37 -0000 1.82
+++ www/firefox-esr/Makefile 26 Sep 2018 11:37:53 -0000
@@ -7,7 +7,7 @@ MOZILLA_VERSION = 60.2.1esr
MOZILLA_BRANCH = release
MOZILLA_PROJECT = firefox
MOZILLA_CODENAME = browser
-REVISION = 0
+REVISION = 1

WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/esr//}
HOMEPAGE = https://www.mozilla.org/firefox/organizations/
@@ -43,6 +43,8 @@ MOZILLA_USE_BUNDLED_HUNSPELL = Yes
BUILD_DEPENDS += lang/rust
# stylo build needs LLVM
BUILD_DEPENDS += devel/llvm
+
+RUN_DEPENDS += lang/rust,-staticlib

WANTLIB += X11-xcb Xcursor Xi fribidi intl xcb xcb-shm ${COMPILER_LIBCXX}

Index: www/mozilla-firefox/Makefile
===================================================================
RCS file: /cvs/ports/www/mozilla-firefox/Makefile,v
retrieving revision 1.361
diff -u -p -r1.361 Makefile
--- www/mozilla-firefox/Makefile 25 Sep 2018 21:16:37 -0000 1.361
+++ www/mozilla-firefox/Makefile 26 Sep 2018 11:38:26 -0000
@@ -9,7 +9,7 @@ MOZILLA_VERSION = 62.0.2
MOZILLA_BRANCH = release
MOZILLA_PROJECT = firefox
MOZILLA_CODENAME = browser
-REVISION = 0
+REVISION = 1

WRKDIST = ${WRKDIR}/${MOZILLA_DIST}-${MOZILLA_DIST_VERSION:C/b[0-9]*//}
HOMEPAGE = https://www.mozilla.org/firefox/
@@ -48,6 +48,8 @@ BUILD_DEPENDS += lang/rust
BUILD_DEPENDS += devel/llvm
# 61 requires both versions of python
BUILD_DEPENDS += lang/python/${MODPY_DEFAULT_VERSION_3}
+
+RUN_DEPENDS += lang/rust,-staticlib

WANTLIB += X11-xcb Xcursor Xi fribidi intl xcb xcb-shm ${COMPILER_LIBCXX}

Index: x11/gnome/librsvg/Makefile
===================================================================
RCS file: /cvs/ports/x11/gnome/librsvg/Makefile,v
retrieving revision 1.136
diff -u -p -r1.136 Makefile
--- x11/gnome/librsvg/Makefile 25 Sep 2018 21:16:37 -0000 1.136
+++ x11/gnome/librsvg/Makefile 26 Sep 2018 11:38:40 -0000
@@ -16,6 +16,7 @@ REVISION= 0
SHARED_LIBS += rsvg-2 39.0 # 46.4
GNOME_VERSION= ${STABLE_VERSION}
BUILD_DEPENDS= lang/rust
+RUN_DEPENDS+= lang/rust,-staticlib
PKG_ARGS= -Dold=0 -Dstable=1
.else
### old
Index: sysutils/exa/Makefile
===================================================================
RCS file: /cvs/ports/sysutils/exa/Makefile,v
retrieving revision 1.1.1.1
diff -u -p -r1.1.1.1 Makefile
--- sysutils/exa/Makefile 27 Apr 2018 09:43:18 -0000 1.1.1.1
+++ sysutils/exa/Makefile 26 Sep 2018 12:00:29 -0000
@@ -5,6 +5,7 @@ COMMENT = ls alternative written in Rus
GH_ACCOUNT = ogham
GH_PROJECT = exa
GH_TAGNAME = v0.8.0
+REVISION = 0

CATEGORIES = sysutils

Index: devel/cargo/cargo.port.mk
===================================================================
RCS file: /cvs/ports/devel/cargo/cargo.port.mk,v
retrieving revision 1.7
diff -u -p -r1.7 cargo.port.mk
--- devel/cargo/cargo.port.mk 24 Feb 2018 18:40:28 -0000 1.7
+++ devel/cargo/cargo.port.mk 26 Sep 2018 11:54:01 -0000
@@ -108,6 +108,11 @@ MODCARGO_BUILDDEP ?= Yes
BUILD_DEPENDS += ${MODCARGO_BUILD_DEPENDS}
.endif

+MODCARGO_STATICLIB ?= Yes
+.if ${MODCARGO_STATICLIB:L} == "yes"
+RUN_DEPENDS += lang/rust,-staticlib
+.endif
+
# Location of cargo binary (default to devel/cargo binary)
MODCARGO_CARGO_BIN ?= ${LOCALBASE}/bin/cargo

Index: mystuff/lang/rust/Makefile
===================================================================
RCS file: /cvs/ports/lang/rust/Makefile,v
retrieving revision 1.80
diff -u -p -r1.80 Makefile
--- mystuff/lang/rust/Makefile 24 Sep 2018 07:09:14 -0000 1.80
+++ mystuff/lang/rust/Makefile 26 Sep 2018 11:48:16 -0000
@@ -10,10 +10,12 @@ DPB_PROPERTIES = parallel

COMMENT-main = compiler for Rust Language
COMMENT-doc = html documentation for rustc
+COMMENT-staticlib = statically compiled Rust libstd

V = 1.29.1
CARGO_V = 0.30.0
DISTNAME = rustc-${V}-src
+REVISION = 0

# rustc bootstrap version
BV-aarch64 = 1.29.0-20180915
@@ -24,8 +26,9 @@ BV = ${BV-${MACHINE_ARCH}}
PKGNAME = rust-${V}
PKGNAME-main = rust-${V}
PKGNAME-doc = rust-doc-${V}
+PKGNAME-staticlib = rust-staticlib-${V}

-MULTI_PACKAGES = -main -doc
+MULTI_PACKAGES = -main -doc -staticlib

CATEGORIES = lang

@@ -38,6 +41,7 @@ PERMIT_PACKAGE_CDROM = Yes

WANTLIB-main = ${COMPILER_LIBCXX} c crypto curl git2 m pthread ssh2 ssl z
WANTLIB-doc =
+WANTLIB-staticlib =

MASTER_SITES = https://static.rust-lang.org/dist/ \
https://dev-static.rust-lang.org/dist/
Index: mystuff/lang/rust/pkg/DESCR-staticlib
===================================================================
RCS file: mystuff/lang/rust/pkg/DESCR-staticlib
diff -N mystuff/lang/rust/pkg/DESCR-staticlib
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ mystuff/lang/rust/pkg/DESCR-staticlib 26 Sep 2018 11:33:16 -0000
@@ -0,0 +1 @@
+package to track ports using statically compiled Rust libstd
Index: mystuff/lang/rust/pkg/PLIST-staticlib
===================================================================
RCS file: mystuff/lang/rust/pkg/PLIST-staticlib
diff -N mystuff/lang/rust/pkg/PLIST-staticlib
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ mystuff/lang/rust/pkg/PLIST-staticlib 26 Sep 2018 11:33:16 -0000
@@ -0,0 +1 @@
+@comment $OpenBSD$

No comments:

Post a Comment