GNU bug report logs -
#27282
Perl 5.26.0 "dotless @INC" [was Re: bug#27227: [PATCH] gnu: perl: Update to 5.26.0.]
Previous Next
Reported by: Leo Famulari <leo <at> famulari.name>
Date: Wed, 7 Jun 2017 22:38:02 UTC
Severity: normal
Tags: patch
Done: Leo Famulari <leo <at> famulari.name>
Bug is archived. No further changes may be made.
To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 27282 in the body.
You can then email your comments to 27282 AT debbugs.gnu.org in the normal way.
Toggle the display of automated, internal messages from the tracker.
Report forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Wed, 07 Jun 2017 22:38:02 GMT)
Full text and
rfc822 format available.
Acknowledgement sent
to
Leo Famulari <leo <at> famulari.name>:
New bug report received and forwarded. Copy sent to
bug-guix <at> gnu.org.
(Wed, 07 Jun 2017 22:38:02 GMT)
Full text and
rfc822 format available.
Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Sun, Jun 04, 2017 at 03:19:39PM -0400, Leo Famulari wrote:
> > >> Leo Famulari <leo <at> famulari.name> writes:
> > >>
> > >> > * gnu/packages/perl.scm (perl): Update to 5.26.0.
> > >> > * gnu/packages/patches/perl-no-sys-dirs.patch: Update patch context for
> > >> > 'hints/linux.sh'.
>
> I merged master into core-updates and pushed this as
> f65805485dac3f8c4586648e3f7e901202095a19.
Building locally, I found that SWIG fails to build with this new Perl
release due to the removal of the current directory from @INC. This
change is mentioned in the Perl release notes:
"We removed the current directory from @INC
We consider this a security change, and although it might cause
discomfort to some users, we had to do it. Both Perl 5 Porters and the
Toolchain Gang put effort into easing the transition to a dot-less
@INC.
If you want to load a module from the current directory, you can still
do this in one the following ways:
[...]
# Use the environment variable
PERL_USE_UNSAFE_INC=1"
http://blogs.perl.org/users/sawyer_x/2017/05/perl-5260-is-now-available.html
It doesn't look like this has been addressed by the SWIG maintainers
yet.
We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
definition, right? Probably we will need to set it in several other
packages as well.
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Thu, 08 Jun 2017 00:26:01 GMT)
Full text and
rfc822 format available.
Message #8 received at 27282 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Wed, Jun 07, 2017 at 06:37:30PM -0400, Leo Famulari wrote:
> We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> definition, right? Probably we will need to set it in several other
> packages as well.
I'm testing this patch locally:
diff --git a/gnu/packages/swig.scm b/gnu/packages/swig.scm
index acf052937..09e9bb92a 100644
--- a/gnu/packages/swig.scm
+++ b/gnu/packages/swig.scm
@@ -41,6 +41,14 @@
(base32
"0k7ljh07rla6223lhvljgg881b2qr7hmrfgic9a0j1pckpislf99"))))
(build-system gnu-build-system)
+ (arguments
+ '(#:phases
+ (modify-phases %standard-phases
+ (add-after 'unpack 'set-env
+ ;; Required since Perl 5.26.0's removal of the current
+ ;; working directory from @INC.
+ ;; TODO Try removing this for later versions of SWIG.
+ (lambda _ (setenv "PERL_USE_UNSAFE_INC" "1") #t)))))
(native-inputs `(("boost" ,boost)
("pcre" ,pcre "bin"))) ;for 'pcre-config'
(inputs `(;; Provide these to run the corresponding tests.
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Thu, 08 Jun 2017 12:30:02 GMT)
Full text and
rfc822 format available.
Message #11 received at 27282 <at> debbugs.gnu.org (full text, mbox):
Leo Famulari <leo <at> famulari.name> skribis:
> Building locally, I found that SWIG fails to build with this new Perl
> release due to the removal of the current directory from @INC. This
> change is mentioned in the Perl release notes:
>
> "We removed the current directory from @INC
>
> We consider this a security change, and although it might cause
> discomfort to some users, we had to do it. Both Perl 5 Porters and the
> Toolchain Gang put effort into easing the transition to a dot-less
> @INC.
>
> If you want to load a module from the current directory, you can still
> do this in one the following ways:
>
> [...]
>
> # Use the environment variable
> PERL_USE_UNSAFE_INC=1"
>
> http://blogs.perl.org/users/sawyer_x/2017/05/perl-5260-is-now-available.html
>
> It doesn't look like this has been addressed by the SWIG maintainers
> yet.
>
> We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> definition, right? Probably we will need to set it in several other
> packages as well.
We can do that, but probably there will be (or there is already) a patch
for SWIG to not rely on having “.” in @INC, no?
Thanks for the heads-up,
Ludo’.
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Thu, 08 Jun 2017 15:30:04 GMT)
Full text and
rfc822 format available.
Message #14 received at 27282 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Thu, Jun 08, 2017 at 02:28:54PM +0200, Ludovic Courtès wrote:
> Leo Famulari <leo <at> famulari.name> skribis:
> > We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> > definition, right? Probably we will need to set it in several other
> > packages as well.
>
> We can do that, but probably there will be (or there is already) a patch
> for SWIG to not rely on having “.” in @INC, no?
I hoped so, but I couldn't find any discussion on the SWIG bug tracker
or mailing list, nor a commit in their source repo.
I guess I should bring it up on their bug tracker :)
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Mon, 12 Jun 2017 02:49:01 GMT)
Full text and
rfc822 format available.
Message #17 received at 27282 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Thu, Jun 08, 2017 at 11:29:16AM -0400, Leo Famulari wrote:
> On Thu, Jun 08, 2017 at 02:28:54PM +0200, Ludovic Courtès wrote:
> > Leo Famulari <leo <at> famulari.name> skribis:
> > > We should set this PERL_USE_UNSAFE_INC variable in the SWIG package
> > > definition, right? Probably we will need to set it in several other
> > > packages as well.
> >
> > We can do that, but probably there will be (or there is already) a patch
> > for SWIG to not rely on having “.” in @INC, no?
>
> I hoped so, but I couldn't find any discussion on the SWIG bug tracker
> or mailing list, nor a commit in their source repo.
>
> I guess I should bring it up on their bug tracker :)
I filed a bug report:
https://github.com/swig/swig/issues/997
In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
before, which is a SWIG that looks for modules in the current working
directory.
Building core-updates locally, I found several other Perl modules that
have the same issue.
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Tue, 13 Jun 2017 19:48:02 GMT)
Full text and
rfc822 format available.
Message #20 received at 27282 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Sun, Jun 11, 2017 at 10:48:02PM -0400, Leo Famulari wrote:
> I filed a bug report:
>
> https://github.com/swig/swig/issues/997
>
> In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
> before, which is a SWIG that looks for modules in the current working
> directory.
The upstream fix has basically the same effect:
https://github.com/swig/swig/commit/8855ef2b482c09da9255079b0fac92d08c8308fb
To avoid adding another patch, I'll push the change to set
PERL_USE_UNSAFE_INC to core-updates soon unless there is an objection.
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Wed, 14 Jun 2017 07:39:01 GMT)
Full text and
rfc822 format available.
Message #23 received at 27282 <at> debbugs.gnu.org (full text, mbox):
Leo Famulari <leo <at> famulari.name> skribis:
> On Sun, Jun 11, 2017 at 10:48:02PM -0400, Leo Famulari wrote:
>> I filed a bug report:
>>
>> https://github.com/swig/swig/issues/997
>>
>> In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
>> before, which is a SWIG that looks for modules in the current working
>> directory.
>
> The upstream fix has basically the same effect:
>
> https://github.com/swig/swig/commit/8855ef2b482c09da9255079b0fac92d08c8308fb
>
> To avoid adding another patch, I'll push the change to set
> PERL_USE_UNSAFE_INC to core-updates soon unless there is an objection.
Sounds good to me. Thanks for taking care of it!
Ludo’.
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Wed, 14 Jun 2017 14:31:01 GMT)
Full text and
rfc822 format available.
Message #26 received at 27282 <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Wed, Jun 14, 2017 at 09:38:12AM +0200, Ludovic Courtès wrote:
> Leo Famulari <leo <at> famulari.name> skribis:
>
> > On Sun, Jun 11, 2017 at 10:48:02PM -0400, Leo Famulari wrote:
> >> I filed a bug report:
> >>
> >> https://github.com/swig/swig/issues/997
> >>
> >> In the meantime, setting PERL_USE_UNSAFE_INC will give us what we had
> >> before, which is a SWIG that looks for modules in the current working
> >> directory.
> >
> > The upstream fix has basically the same effect:
> >
> > https://github.com/swig/swig/commit/8855ef2b482c09da9255079b0fac92d08c8308fb
> >
> > To avoid adding another patch, I'll push the change to set
> > PERL_USE_UNSAFE_INC to core-updates soon unless there is an objection.
>
> Sounds good to me. Thanks for taking care of it!
Alright, pushed as 503c8c5882550005a7e9d3058a5f6d22f9c33f63. I'll keep
this bug open for a while to document further instances of this problem.
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to
bug-guix <at> gnu.org:
bug#27282; Package
guix.
(Wed, 02 Aug 2017 22:11:01 GMT)
Full text and
rfc822 format available.
Message #29 received at 27282 <at> debbugs.gnu.org (full text, mbox):
Heya,
Leo Famulari <leo <at> famulari.name> skribis:
> Alright, pushed as 503c8c5882550005a7e9d3058a5f6d22f9c33f63. I'll keep
> this bug open for a while to document further instances of this problem.
I think we’re mostly done with this bug, or am I optimistic?
Ludo’.
Reply sent
to
Leo Famulari <leo <at> famulari.name>:
You have taken responsibility.
(Wed, 02 Aug 2017 22:42:02 GMT)
Full text and
rfc822 format available.
Notification sent
to
Leo Famulari <leo <at> famulari.name>:
bug acknowledged by developer.
(Wed, 02 Aug 2017 22:42:03 GMT)
Full text and
rfc822 format available.
Message #34 received at 27282-done <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
On Thu, Aug 03, 2017 at 12:10:00AM +0200, Ludovic Courtès wrote:
> Heya,
>
> Leo Famulari <leo <at> famulari.name> skribis:
>
> > Alright, pushed as 503c8c5882550005a7e9d3058a5f6d22f9c33f63. I'll keep
> > this bug open for a while to document further instances of this problem.
>
> I think we’re mostly done with this bug, or am I optimistic?
Yes, I think so. We can always re-open if necessary :)
[signature.asc (application/pgp-signature, inline)]
bug archived.
Request was from
Debbugs Internal Request <help-debbugs <at> gnu.org>
to
internal_control <at> debbugs.gnu.org.
(Thu, 31 Aug 2017 11:24:05 GMT)
Full text and
rfc822 format available.
This bug report was last modified 6 years and 233 days ago.
Previous Next
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.