Re: [gentoo-portage-dev] Re: [PATCH v2 3/3] _emerge.Ebuild*: delay creating DISTDIR shadow until src_unpack

[Michał Górny]

W dniu czw, 25.01.2018 o godzinie 21∶30 -0800, użytkownik Zac Medico
napisał:
> On 01/25/2018 01:11 AM, Michał Górny wrote:
> > W dniu czw, 25.01.2018 o godzinie 10∶07 +0100, użytkownik Michael
> > Haubenwallner napisał:
> > > Hi,
> > >
> > > ${Subject} ringing a bell here:
> > >
> > > dev-db/oracle-instantclient is fetch restricted. As a binary package with
> > > multiple USE options there's a bunch of files to download - even for
> > > multiple archs when multilib is active.
> > >
> > > So in pkg_nofetch() I'm telling the user whether a file to download is
> > > "already here" or "still absent", by testing if $A exists in $DISTDIR.
> > >
> > > With ${Subject}, I'm wondering if DISTDIR is created for pkg_nofetch too.
> > >
> >
> > You're doing the wrong thing then. DISTDIR is not allowed
> > in pkg_nofetch().
>
> It seems to be a common assumption that it's allowed, this command
> currently shows 163 results in the gentoo repo:
>
> git grep -l pkg_nofetch | xargs grep 'e\(log\|info\).*DISTDIR' | wc -l
>
> We should double check with the PMS maintainers to see if they think
> it's worthy of an exception. Otherwise, we need to announce the issue on
> the gentoo-dev mailing list.

PMS maintainers already verified that back during the first run of those
patches. However, we believe the only reasonable way to get this out of
pkg_nofetch() is to actually stop it from working, so people would stop
using it.

> Furthermore, you're touching files whose hashes have
> > not been verified which is twice wrong.
>
> Checking if files exist is not really a security risk, but yes, we
> should conform to the spec.

There's no technical reason why the ebuild wouldn't have done more than
checking if they exist.

-- 
Best regards,
Michał Górny