Re: update: lang/rust 1.29.1 (security)

On Wed, Sep 26, 2018 at 02:13:47PM +0200, Sebastien Marie wrote:
> On Tue, Sep 25, 2018 at 04:53:54PM +0100, Stuart Henderson wrote:
> > >
> > > A possible way could be:
> > > - having a sub-package -libstd on lang/rust (which would be empty or almost)
> > > - add RUN_DEPENDS+=lang/rust,-libstd to port using rustc
> > >
> > > when lang/rust is updated, the subpackage rust-libstd will automatically
> > > crank, and so the signature of packages with RUN_DEPENDS will change,
> > > and pkg_add -u will update. Does it make sens ? The drawback would be to
> > > manually maintain the RUN_DEPENDS, but it is low overhead and one-time
> > > only.
> >
> > This would work, it feels a little 'dirty' but not too bad. There's a
> > similar problem in lang/go fwiw. If this is done via RUN_DEPENDS,
> > then PKGSPEC can be used to force updates when needed, without having
> > to bump dependent ports.
> >
> > But for the immediate case, just bumping them makes sense for now,
> > I don't think we'll have time for anything more complex.
> >
>
> The following diff tries to implement it.
>
> Several parts:
> - new subpackage lang/rust,-staticlib (with empty PLIST)
>
> - module devel/cargo will add (by default, but it is overridable)
> RUN_DEPENDS += lang/rust,-staticlib
>
> - for ports not using the module add an explicit RUN_DEPENDS
>
> - every impacted port (directly by RUN_DEPENDS addition or indirectly
> by devel/cargo usage) is bumped
>
> I did a quick test with ripgrep. When I modify lang/rust version (with
> REVISION++), the packaging of ripgrep seems to correctly incoporate the
> change:
>
> ===> Building package for ripgrep-0.8.1p2
> Create /home/semarie/repos/openbsd/ports/packages/amd64/all/ripgrep-0.8.1p2.tgz
> Creating package ripgrep-0.8.1p2
> /home/semarie/repos/openbsd/ports/plist/amd64/ripgrep-0.8.1p2 was updated
> lang/rust,-staticlib:rust-staticlib-*:rust-staticlib-1.29.1p0 -> lang/rust,-staticlib:rust-staticlib-*:rust-staticlib-1.29.1p1
> Link to /home/semarie/repos/openbsd/ports/packages/amd64/ftp/ripgrep-0.8.1p2.tgz
> Link to /home/semarie/repos/openbsd/ports/packages/amd64/cdrom/ripgrep-0.8.1p2.tgz
>

After thought, I think it shouldn't be commited as it.
So the diff is mostly for "demonstration" that it should work.

A proper fix would be to have a STATICLIB_DEPENDS and lets the
infrastructure to make it part of the signature, without the need of a
empty package. And we could add it gradually in ports.

For lang/rust, it would STATICLIB_DEPENDS to devel/llvm, as it uses
libLLVM.a and its compoments. So a change on devel/llvm would be noticed,
and the Rust compiler updated.

I think it could have value in several area. But it is too late for 6.4
anyway. So we have time to think about it.

Thanks.
--
Sebastien Marie