bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1341 bytes --]

On Sun, Jun 04, 2017 at 03:19:39PM -0400, Leo Famulari wrote:
> > >> Leo Famulari <leo@famulari.name> writes:
> > >> 
> > >> > * gnu/packages/perl.scm (perl): Update to 5.26.0.
> > >> > * gnu/packages/patches/perl-no-sys-dirs.patch: Update patch context for
> > >> > 'hints/linux.sh'.
> 
> I merged master into core-updates and pushed this as
> f65805485dac3f8c4586648e3f7e901202095a19.

Building locally, I found that SWIG fails to build with this new Perl
release due to the removal of the current directory from @INC. This
change is mentioned in the Perl release notes:

"We removed the current directory from @INC

We consider this a security change, and although it might cause
discomfort to some users, we had to do it. Both Perl 5 Porters and the
Toolchain Gang put effort into easing the transition to a dot-less
@INC.

If you want to load a module from the current directory, you can still
do this in one the following ways:

[...]

# Use the environment variable
PERL_USE_UNSAFE_INC=1"

http://blogs.perl.org/users/sawyer_x/2017/05/perl-5260-is-now-available.html

It doesn't look like this has been addressed by the SWIG maintainers
yet.

We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
definition, right? Probably we will need to set it in several other
packages as well.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#27282: Perl 5.26.0 "dotless @INC"

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1085 bytes --]

On Wed, Jun 07, 2017 at 06:37:30PM -0400, Leo Famulari wrote:
> We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> definition, right? Probably we will need to set it in several other
> packages as well.

I'm testing this patch locally:

diff --git a/gnu/packages/swig.scm b/gnu/packages/swig.scm
index acf052937..09e9bb92a 100644
--- a/gnu/packages/swig.scm
+++ b/gnu/packages/swig.scm
@@ -41,6 +41,14 @@
               (base32
                "0k7ljh07rla6223lhvljgg881b2qr7hmrfgic9a0j1pckpislf99"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'set-env
+           ;; Required since Perl 5.26.0's removal of the current
+           ;; working directory from @INC.
+           ;; TODO Try removing this for later versions of SWIG.
+           (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1") #t)))))
     (native-inputs `(("boost" ,boost)
                      ("pcre" ,pcre "bin")))       ;for 'pcre-config'
     (inputs `(;; Provide these to run the corresponding tests.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> Building locally, I found that SWIG fails to build with this new Perl
> release due to the removal of the current directory from @INC. This
> change is mentioned in the Perl release notes:
>
> "We removed the current directory from @INC
>
> We consider this a security change, and although it might cause
> discomfort to some users, we had to do it. Both Perl 5 Porters and the
> Toolchain Gang put effort into easing the transition to a dot-less
> @INC.
>
> If you want to load a module from the current directory, you can still
> do this in one the following ways:
>
> [...]
>
> # Use the environment variable
> PERL_USE_UNSAFE_INC=1"
>
> http://blogs.perl.org/users/sawyer_x/2017/05/perl-5260-is-now-available.html
>
> It doesn't look like this has been addressed by the SWIG maintainers
> yet.
>
> We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> definition, right? Probably we will need to set it in several other
> packages as well.

We can do that, but probably there will be (or there is already) a patch
for SWIG to not rely on having “.” in @INC, no?

Thanks for the heads-up,
Ludo’.

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 599 bytes --]

On Thu, Jun 08, 2017 at 02:28:54PM +0200, Ludovic Courtès wrote:
> Leo Famulari <leo@famulari.name> skribis:
> > We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> > definition, right? Probably we will need to set it in several other
> > packages as well.
> 
> We can do that, but probably there will be (or there is already) a patch
> for SWIG to not rely on having “.” in @INC, no?

I hoped so, but I couldn't find any discussion on the SWIG bug tracker
or mailing list, nor a commit in their source repo.

I guess I should bring it up on their bug tracker :)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 1008 bytes --]

On Thu, Jun 08, 2017 at 11:29:16AM -0400, Leo Famulari wrote:
> On Thu, Jun 08, 2017 at 02:28:54PM +0200, Ludovic Courtès wrote:
> > Leo Famulari <leo@famulari.name> skribis:
> > > We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> > > definition, right? Probably we will need to set it in several other
> > > packages as well.
> > 
> > We can do that, but probably there will be (or there is already) a patch
> > for SWIG to not rely on having “.” in @INC, no?
> 
> I hoped so, but I couldn't find any discussion on the SWIG bug tracker
> or mailing list, nor a commit in their source repo.
> 
> I guess I should bring it up on their bug tracker :)

I filed a bug report:

https://github.com/swig/swig/issues/997

In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
before, which is a SWIG that looks for modules in the current working
directory.

Building core-updates locally, I found several other Perl modules that
have the same issue.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 564 bytes --]

On Sun, Jun 11, 2017 at 10:48:02PM -0400, Leo Famulari wrote:
> I filed a bug report:
> 
> https://github.com/swig/swig/issues/997
> 
> In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
> before, which is a SWIG that looks for modules in the current working
> directory.

The upstream fix has basically the same effect:

https://github.com/swig/swig/commit/8855ef2b482c09da9255079b0fac92d08c8308fb

To avoid adding another patch, I'll push the change to set
PERL_USE_UNSAFE_INC to core-updates soon unless there is an objection.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> On Sun, Jun 11, 2017 at 10:48:02PM -0400, Leo Famulari wrote:
>> I filed a bug report:
>> 
>> https://github.com/swig/swig/issues/997
>> 
>> In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
>> before, which is a SWIG that looks for modules in the current working
>> directory.
>
> The upstream fix has basically the same effect:
>
> https://github.com/swig/swig/commit/8855ef2b482c09da9255079b0fac92d08c8308fb
>
> To avoid adding another patch, I'll push the change to set
> PERL_USE_UNSAFE_INC to core-updates soon unless there is an objection.

Sounds good to me.  Thanks for taking care of it!

Ludo’.

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 934 bytes --]

On Wed, Jun 14, 2017 at 09:38:12AM +0200, Ludovic Courtès wrote:
> Leo Famulari <leo@famulari.name> skribis:
> 
> > On Sun, Jun 11, 2017 at 10:48:02PM -0400, Leo Famulari wrote:
> >> I filed a bug report:
> >> 
> >> https://github.com/swig/swig/issues/997
> >> 
> >> In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
> >> before, which is a SWIG that looks for modules in the current working
> >> directory.
> >
> > The upstream fix has basically the same effect:
> >
> > https://github.com/swig/swig/commit/8855ef2b482c09da9255079b0fac92d08c8308fb
> >
> > To avoid adding another patch, I'll push the change to set
> > PERL_USE_UNSAFE_INC to core-updates soon unless there is an objection.
> 
> Sounds good to me.  Thanks for taking care of it!

Alright, pushed as 503c8c5882550005a7e9d3058a5f6d22f9c33f63. I'll keep
this bug open for a while to document further instances of this problem.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Ludovic Courtès]

Heya,

Leo Famulari <leo@famulari.name> skribis:

> Alright, pushed as 503c8c5882550005a7e9d3058a5f6d22f9c33f63. I'll keep
> this bug open for a while to document further instances of this problem.

I think we’re mostly done with this bug, or am I optimistic?

Ludo’.

bug#27282: Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 411 bytes --]

On Thu, Aug 03, 2017 at 12:10:00AM +0200, Ludovic Courtès wrote:
> Heya,
> 
> Leo Famulari <leo@famulari.name> skribis:
> 
> > Alright, pushed as 503c8c5882550005a7e9d3058a5f6d22f9c33f63. I'll keep
> > this bug open for a while to document further instances of this problem.
> 
> I think we’re mostly done with this bug, or am I optimistic?

Yes, I think so. We can always re-open if necessary :)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]