bug#30006: bzip2 does not provide libbz2.so

bug#30006: bzip2 does not provide libbz2.so

[Ludovic Courtès]

Our current bzip2 package does not provide libbz2.so:

--8<---------------cut here---------------start------------->8---
$ ls $(guix build bzip2)/lib
libbz2.a  libbz2.so.1.0  libbz2.so.1.0.6
--8<---------------cut here---------------end--------------->8---

Consequently, software that uses libbz2 always ends up
statically-linking it.  Thus, security issues in libbz2 cannot be
grafted.

Ludo’.

bug#30006: bzip2 does not provide libbz2.so

[Marius Bakke]

[-- Attachment #1.1: Type: text/plain, Size: 484 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> Our current bzip2 package does not provide libbz2.so:
>
> --8<---------------cut here---------------start------------->8---
> $ ls $(guix build bzip2)/lib
> libbz2.a  libbz2.so.1.0  libbz2.so.1.0.6
> --8<---------------cut here---------------end--------------->8---
>
> Consequently, software that uses libbz2 always ends up
> statically-linking it.  Thus, security issues in libbz2 cannot be
> grafted.

WDYT of this patch?


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-gnu-bzip2-Provide-libbz2.so.patch --]
[-- Type: text/x-patch, Size: 1266 bytes --]

From 1eec25f2aad3d20289ced4fbca9a614f6d614fa6 Mon Sep 17 00:00:00 2001
From: Marius Bakke <mbakke@fastmail.com>
Date: Fri, 23 Mar 2018 12:56:45 +0100
Subject: [PATCH] gnu: bzip2: Provide libbz2.so.

Fixes <https://bugs.gnu.org/30006>.

* gnu/packages/compression.scm (bzip2)[arguments]: In
INSTALL-SHARED-LIBS-PHASE, add a symlink.
---
 gnu/packages/compression.scm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index b158feac4..fd111e579 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -272,6 +272,9 @@ file; as a result, it is often used in conjunction with \"tar\", resulting in
            (lambda* (#:key outputs #:allow-other-keys)
              (let* ((out    (assoc-ref outputs "out"))
                     (libdir (string-append out "/lib")))
+               ;; The Make target above does not create "libbz2.so", only
+               ;; the versioned libs, so we have to create it ourselves.
+               (symlink "libbz2.so.1.0" "libbz2.so")
                (for-each (lambda (file)
                            (let ((base (basename file)))
                              (format #t "installing `~a' to `~a'~%"
-- 
2.16.2


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

bug#30006: bzip2 does not provide libbz2.so

[Tobias Geerinckx-Rice]

Marius,

On 2018-03-23 13:02, Marius Bakke wrote:
> diff --git a/gnu/packages/compression.scm 
> b/gnu/packages/compression.scm
> index b158feac4..fd111e579 100644
> --- a/gnu/packages/compression.scm
> +++ b/gnu/packages/compression.scm
> @@ -272,6 +272,9 @@ file; as a result, it is often used in conjunction 
> with \"tar\", resulting in
>             (lambda* (#:key outputs #:allow-other-keys)
>               (let* ((out    (assoc-ref outputs "out"))
>                      (libdir (string-append out "/lib")))
> +               ;; The Make target above does not create "libbz2.so", 
> only
> +               ;; the versioned libs, so we have to create it 
> ourselves.
> +               (symlink "libbz2.so.1.0" "libbz2.so")

How about symlinking to (string-append ... version) directly?
Seems more robust & worked fine when I tried it, I think.™

Kind regards,

T G-R

Sent from a Web browser. Excuse or enjoy my brevity.

bug#30006: bzip2 does not provide libbz2.so

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1509 bytes --]

Tobias Geerinckx-Rice <me@tobias.gr> writes:

> Marius,
>
> On 2018-03-23 13:02, Marius Bakke wrote:
>> diff --git a/gnu/packages/compression.scm 
>> b/gnu/packages/compression.scm
>> index b158feac4..fd111e579 100644
>> --- a/gnu/packages/compression.scm
>> +++ b/gnu/packages/compression.scm
>> @@ -272,6 +272,9 @@ file; as a result, it is often used in conjunction 
>> with \"tar\", resulting in
>>             (lambda* (#:key outputs #:allow-other-keys)
>>               (let* ((out    (assoc-ref outputs "out"))
>>                      (libdir (string-append out "/lib")))
>> +               ;; The Make target above does not create "libbz2.so", 
>> only
>> +               ;; the versioned libs, so we have to create it 
>> ourselves.
>> +               (symlink "libbz2.so.1.0" "libbz2.so")
>
> How about symlinking to (string-append ... version) directly?
> Seems more robust & worked fine when I tried it, I think.™

That makes sense.  I just wanted to stay close to the typical Autotools
way of creating these links, where libfoo.so points to libfoo.so.1 which
points to libfoo.so.1.2.  I'll change to (version-major+minor ...)
instead, in the off chance that bzip2 ever gets a new version.

Side note: "copy-file" (and thus "install-file") actually dereferences
symlinks, so in the end you get three copies of the same library.  Is
there an alternative to "copy-file" that preserves soft links?  Not that
it matters in practice due to deduplication, but still...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

bug#30006: bzip2 does not provide libbz2.so

[Mark H Weaver]

Hi,

Tobias Geerinckx-Rice <me@tobias.gr> writes:

> On 2018-03-23 13:02, Marius Bakke wrote:
>> diff --git a/gnu/packages/compression.scm
>> b/gnu/packages/compression.scm
>> index b158feac4..fd111e579 100644
>> --- a/gnu/packages/compression.scm
>> +++ b/gnu/packages/compression.scm
>> @@ -272,6 +272,9 @@ file; as a result, it is often used in
>> conjunction with \"tar\", resulting in
>>             (lambda* (#:key outputs #:allow-other-keys)
>>               (let* ((out    (assoc-ref outputs "out"))
>>                      (libdir (string-append out "/lib")))
>> +               ;; The Make target above does not create "libbz2.so", only
>> +               ;; the versioned libs, so we have to create it ourselves.
>> +               (symlink "libbz2.so.1.0" "libbz2.so")
>
> How about symlinking to (string-append ... version) directly?
> Seems more robust & worked fine when I tried it, I think.™

In general, the version numbers at the end of shared library names like
"libbz2.so.1.0" do not necessarily match the version number of the
corresponding source release.  Therefore, I don't think we should write
code that assumes that those two versions will coincide.

However, I agree that it would be better not to hardcode the "1.0".  I
would suggest using 'find-files' to find the versioned shared library,
and to verify that there is exactly one match.  (ice-9 match) provides
an elegant way to check for a singleton list while matching its element.

What do you think?

Thanks for working on it.

      Mark

bug#30006: bzip2 does not provide libbz2.so

[Tobias Geerinckx-Rice]

Marius, Mark,

On 2018-03-23 21:50, Mark H Weaver wrote:
> Hi,
> 
> Tobias Geerinckx-Rice <me@tobias.gr> writes:
> 
>> On 2018-03-23 13:02, Marius Bakke wrote:
>>> diff --git a/gnu/packages/compression.scm
>>> b/gnu/packages/compression.scm
>>> index b158feac4..fd111e579 100644
>>> --- a/gnu/packages/compression.scm
>>> +++ b/gnu/packages/compression.scm
>>> @@ -272,6 +272,9 @@ file; as a result, it is often used in
>>> conjunction with \"tar\", resulting in
>>>             (lambda* (#:key outputs #:allow-other-keys)
>>>               (let* ((out    (assoc-ref outputs "out"))
>>>                      (libdir (string-append out "/lib")))
>>> +               ;; The Make target above does not create "libbz2.so", 
>>> only
>>> +               ;; the versioned libs, so we have to create it 
>>> ourselves.
>>> +               (symlink "libbz2.so.1.0" "libbz2.so")
>> 
>> How about symlinking to (string-append ... version) directly?
>> Seems more robust & worked fine when I tried it, I think.™
> 
> In general, the version numbers at the end of shared library names like
> "libbz2.so.1.0" do not necessarily match the version number of the
> corresponding source release.  Therefore, I don't think we should write
> code that assumes that those two versions will coincide.

Do note that I'm not suggesting doing so in general; just in the case of 
bzip2 where that rule does historically hold. If that ever changes, so 
will the ‘1.0’ assumption.

(I did substitute ‘version’ for the ‘version-major+minor’ I actually 
used for... simplicity, I guess, which was probably ill advised.)

> However, I agree that it would be better not to hardcode the "1.0".  I
> would suggest using 'find-files' to find the versioned shared library,
> and to verify that there is exactly one match.  (ice-9 match) provides
> an elegant way to check for a singleton list while matching its 
> element.

I wasn't aware of such an elegant possibility. A perfect fit IMO :-)

Thanks,

T G-R

Sent from a Web browser. Excuse or enjoy my brevity.

bug#30006: bzip2 does not provide libbz2.so

[Ludovic Courtès]

Hey Marius,

Marius Bakke <mbakke@fastmail.com> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Our current bzip2 package does not provide libbz2.so:
>>
>> --8<---------------cut here---------------start------------->8---
>> $ ls $(guix build bzip2)/lib
>> libbz2.a  libbz2.so.1.0  libbz2.so.1.0.6
>> --8<---------------cut here---------------end--------------->8---
>>
>> Consequently, software that uses libbz2 always ends up
>> statically-linking it.  Thus, security issues in libbz2 cannot be
>> grafted.
>
> WDYT of this patch?
>
> From 1eec25f2aad3d20289ced4fbca9a614f6d614fa6 Mon Sep 17 00:00:00 2001
> From: Marius Bakke <mbakke@fastmail.com>
> Date: Fri, 23 Mar 2018 12:56:45 +0100
> Subject: [PATCH] gnu: bzip2: Provide libbz2.so.
>
> Fixes <https://bugs.gnu.org/30006>.
>
> * gnu/packages/compression.scm (bzip2)[arguments]: In
> INSTALL-SHARED-LIBS-PHASE, add a symlink.

LGTM, thank you!

Ludo’.

bug#30006: bzip2 does not provide libbz2.so

[Ludovic Courtès]

Marius Bakke <mbakke@fastmail.com> skribis:

> Tobias Geerinckx-Rice <me@tobias.gr> writes:
>
>> Marius,
>>
>> On 2018-03-23 13:02, Marius Bakke wrote:
>>> diff --git a/gnu/packages/compression.scm 
>>> b/gnu/packages/compression.scm
>>> index b158feac4..fd111e579 100644
>>> --- a/gnu/packages/compression.scm
>>> +++ b/gnu/packages/compression.scm
>>> @@ -272,6 +272,9 @@ file; as a result, it is often used in conjunction 
>>> with \"tar\", resulting in
>>>             (lambda* (#:key outputs #:allow-other-keys)
>>>               (let* ((out    (assoc-ref outputs "out"))
>>>                      (libdir (string-append out "/lib")))
>>> +               ;; The Make target above does not create "libbz2.so", 
>>> only
>>> +               ;; the versioned libs, so we have to create it 
>>> ourselves.
>>> +               (symlink "libbz2.so.1.0" "libbz2.so")
>>
>> How about symlinking to (string-append ... version) directly?
>> Seems more robust & worked fine when I tried it, I think.™
>
> That makes sense.  I just wanted to stay close to the typical Autotools
> way of creating these links, where libfoo.so points to libfoo.so.1 which
> points to libfoo.so.1.2.  I'll change to (version-major+minor ...)
> instead, in the off chance that bzip2 ever gets a new version.

Note that there’s no reason for the SONAME numbers to match the version
number (it’s even not recommended to do that because it may not carry
the relevant info regarding ABI compatibility.)

So I think the hard-coded number is fine, but we should probably do:

  (symlink … "libbz2.so")
  (unless (file-exists? "libbz2.so)
    (error "wrong symlink target!" (readlink "libbz2.so")))

to be on the safe side.

> Side note: "copy-file" (and thus "install-file") actually dereferences
> symlinks, so in the end you get three copies of the same library.  Is
> there an alternative to "copy-file" that preserves soft links?  Not that
> it matters in practice due to deduplication, but still...

There’s no such function, which is unfortunate.  But I agree it’s nicer
to preserve symlinks in this case.

Perhaps we should actually do:

  (with-directory-excursion libdir
    (symlink … "libbz2.so"))

?

Thanks,
Ludo’.

bug#30006: bzip2 does not provide libbz2.so

[Marius Bakke]

[-- Attachment #1.1: Type: text/plain, Size: 728 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> There’s no such function, which is unfortunate.  But I agree it’s nicer
> to preserve symlinks in this case.
>
> Perhaps we should actually do:
>
>   (with-directory-excursion libdir
>     (symlink … "libbz2.so"))

Thanks for the feedback everyone.  I settled on a slightly different
solution, that first extracts the (full) soversion from the built
library, then creates symlinks for each "sub-version".

It assumes that the major version is "1".  That could be circumvented
with a regex, but I'm not sure if it's worth the effort.

As an added bonus, this also creates "libbz2.so.1" which was missing too.

WDYT of this approach?  Can it be made simpler?


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: 0001-gnu-bzip2-Provide-libbz2.so-and-libbz2.so.1.patch --]
[-- Type: text/x-patch, Size: 2831 bytes --]

From 6c903b1da1ab64c4f52581c7debb82b65a6afb0e Mon Sep 17 00:00:00 2001
From: Marius Bakke <mbakke@fastmail.com>
Date: Mon, 26 Mar 2018 19:24:59 +0200
Subject: [PATCH] gnu: bzip2: Provide libbz2.so and libbz2.so.1.

Fixes <https://bugs.gnu.org/30006>.

* gnu/packages/compression.scm (bzip2)[arguments]: Rework
INSTALL-SHARED-LIBS-PHASE to manage all library symlinks.
---
 gnu/packages/compression.scm | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 3bcc09bd3..7c853e432 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -271,15 +271,28 @@ file; as a result, it is often used in conjunction with \"tar\", resulting in
          (add-after 'install 'install-shared-lib
            (lambda* (#:key outputs #:allow-other-keys)
              (let* ((out    (assoc-ref outputs "out"))
-                    (libdir (string-append out "/lib")))
-               (for-each (lambda (file)
-                           (let ((base (basename file)))
-                             (format #t "installing `~a' to `~a'~%"
-                                     base libdir)
-                             (copy-file file
-                                        (string-append libdir "/" base))))
-                         (find-files "." "^libbz2\\.so")))
-             #t))
+                    (libdir (string-append out "/lib"))
+                    ;; Find the actual library (e.g. "libbz2.so.1.0.6").
+                    (lib (string-drop
+                          (car (find-files
+                                "."
+                                (lambda (file stat)
+                                  (and (string-prefix? "./libbz2.so.1" file)
+                                       (eq? 'regular (stat:type stat))))))
+                          2))
+                    (soversion (string-drop lib (string-length "libbz2.so."))))
+               ;; The Makefile above does not have an 'install' target, nor
+               ;; does it create the versioned symlinks, so we handle it here.
+               (install-file lib libdir)
+               (with-directory-excursion libdir
+                 (let ((libs (string-split soversion #\.))
+                       (base "libbz2.so"))
+                   (map (lambda (so)
+                          (let ((next (string-append base "." so)))
+                            (symlink next base)
+                            (set! base next)))
+                        libs)))
+               #t)))
          (add-after 'install-shared-lib 'patch-scripts
            (lambda* (#:key outputs inputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out")))
-- 
2.16.2


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

bug#30006: bzip2 does not provide libbz2.so

[Ludovic Courtès]

Hello Marius,

Marius Bakke <mbakke@fastmail.com> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> There’s no such function, which is unfortunate.  But I agree it’s nicer
>> to preserve symlinks in this case.
>>
>> Perhaps we should actually do:
>>
>>   (with-directory-excursion libdir
>>     (symlink … "libbz2.so"))
>
> Thanks for the feedback everyone.  I settled on a slightly different
> solution, that first extracts the (full) soversion from the built
> library, then creates symlinks for each "sub-version".
>
> It assumes that the major version is "1".  That could be circumvented
> with a regex, but I'm not sure if it's worth the effort.
>
> As an added bonus, this also creates "libbz2.so.1" which was missing too.
>
> WDYT of this approach?  Can it be made simpler?

Sounds reasonable to me.  I have a suggestion:

> From 6c903b1da1ab64c4f52581c7debb82b65a6afb0e Mon Sep 17 00:00:00 2001
> From: Marius Bakke <mbakke@fastmail.com>
> Date: Mon, 26 Mar 2018 19:24:59 +0200
> Subject: [PATCH] gnu: bzip2: Provide libbz2.so and libbz2.so.1.
>
> Fixes <https://bugs.gnu.org/30006>.
>
> * gnu/packages/compression.scm (bzip2)[arguments]: Rework
> INSTALL-SHARED-LIBS-PHASE to manage all library symlinks.

[...]

> +               (with-directory-excursion libdir
> +                 (let ((libs (string-split soversion #\.))
> +                       (base "libbz2.so"))
> +                   (map (lambda (so)
> +                          (let ((next (string-append base "." so)))
> +                            (symlink next base)
> +                            (set! base next)))
> +                        libs)))

To avoid ‘set!’, I’d write it along these lines:

  ;; Create symlinks libbz2.so.1.2 -> libbz2.so.1, etc.
  (let loop ((base "libbz2.so")
             (numbers (string-split soversion #\.)))
    (unless (null? numbers)
      (let ((so-file (string-append base "." (car numbers))))
        (symlink so-file base)
        (loop so-file (cdr numbers)))))

Otherwise LGTM.

Thank you!

Ludo’.

bug#30006: bzip2 does not provide libbz2.so

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 1412 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> Hello Marius,
>
> Marius Bakke <mbakke@fastmail.com> skribis:
>
>> Ludovic Courtès <ludo@gnu.org> writes:
>>
>>> There’s no such function, which is unfortunate.  But I agree it’s nicer
>>> to preserve symlinks in this case.
>>>
>>> Perhaps we should actually do:
>>>
>>>   (with-directory-excursion libdir
>>>     (symlink … "libbz2.so"))
>>
>> Thanks for the feedback everyone.  I settled on a slightly different
>> solution, that first extracts the (full) soversion from the built
>> library, then creates symlinks for each "sub-version".
>>
>> It assumes that the major version is "1".  That could be circumvented
>> with a regex, but I'm not sure if it's worth the effort.
>>
>> As an added bonus, this also creates "libbz2.so.1" which was missing too.
>>
>> WDYT of this approach?  Can it be made simpler?
>
> Sounds reasonable to me.  I have a suggestion:

[...]

> To avoid ‘set!’, I’d write it along these lines:
>
>   ;; Create symlinks libbz2.so.1.2 -> libbz2.so.1, etc.
>   (let loop ((base "libbz2.so")
>              (numbers (string-split soversion #\.)))
>     (unless (null? numbers)
>       (let ((so-file (string-append base "." (car numbers))))
>         (symlink so-file base)
>         (loop so-file (cdr numbers)))))

This is much nicer, thanks!  I've pushed the patch with this improvement.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]