Gentoo Archives: gentoo-dev

From: Michael Cummings <mcummings@g.o>
To: gentoo-dev@××××××××××××.org
Subject: [gentoo-dev] Pre-emptive apology for perl snafu this afternoon
Date: Fri, 11 Mar 2005 22:48:30
1 I posted a tested ebuild for perl this afternoon to address an rmtree
2 vulnerability in File::Path. This ebuild was tested on 3 arches and 6
3 boxes total without an issue - the patch was to the .pm file, code that
4 isn't touched by perl until you invoke it with your own perl code (ie,
5 not compiled code that might be swayed by arch differences, gcc
6 differences, what have you).
8 Turns out, though, there was a flaw in my ordering of the patch. The
9 patched File::Path invokes, which typically isn't created until
10 after File::Path is built into your perl during the make phase. Because
11 didn't exist yet in the chroot, it was pulling it from folks'
12 installed perl. One of the first things in this particular module is to
13 check that the kernel and platform hardcoded in it at perl build time
14 match what was used during the original install of your current perl
15 according to No problem - unless you've changed kernel
16 versions. Because during the make process the file is sourced by perl,
17 and during that sourcing (ok, not the right word, but I'm talking to
18 you, the masses) it attempted to require, or pull in, the, and
19 failing to find a new one in the unpacked source, it pulled the one on
20 the main system. And therein began the mess. Two values that would
21 normally never appear to perl to be out of sync were suddenly horribly
22 wrong on any box that had had a kernel upgrade since the last perl
23 install.
25 This is now fixed by moving the patch to post install in image, but
26 prior to the install on your filesystem. I have to give thanks to jat, a
27 user on irc who talked me down a few times and inadvertently gave me the
28 inspiration to move the patch (rather than the messy solutions I was
29 considering), and to seemant, who without question or hesitation offered
30 me root on a broken box so I could properly work this out so quickly.
31 Without either of them I wouldn't have gotten it so soon.
33 So for those of you who sync'd this afternoon, please re-sync. If you
34 tried to emerge perl and got a weird message about kernel versions
35 mismatching, and want to add your gripes in bug 84868, that's fine, but
36 sync again and you will be all set.
38 I have to say, this is the first time in almost two years that I've
39 managed to break perl. Gotta count for something that its been so long
40 :)
42 -Michael


File name MIME type
signature.asc application/pgp-signature


Subject Author
Re: [gentoo-dev] Pre-emptive apology for perl snafu this afternoon Martin Schlemmer <azarah@g.o>