3976 2013-03-04 12:15:52 +0000 Support ~ in package versions 2017-07-31 16:44:47 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 1.4 x86 Multiple RESOLVED FIXED Medium enhancement Future 1 richard.purdie unassigned jessica.zhang meta.mr.watcher meta.watcher n3npq ross.burton sgw --- --- Don't know oldest_to_newest 30397 0 richard.purdie 2013-03-04 12:15:52 +0000 We should support the ~ character in package versions. As far as I know the status is: * Bitbake supports them * opkg itself supports them since 2008: http://code.google.com/p/opkg/source/detail?spec=svn40&r=40 * opkg-utils doesn't (e.g. opkg-compare-versions) * rpm packaging code does not 'invalid tag value("^[A-Za-z0-9+._]+$") Version: Version: 0.20~rc1+git0+fdb6c0402337d9607c7a39155088eaf033742752' from do_package_write_rpm * Status of other parts of the system is unknown 32600 1 n3npq 2013-04-24 16:34:17 +0000 Tracked at https://bugs.launchpad.net/rpm/+bug/1172341 34777 2 ross.burton 2013-07-23 10:36:35 +0000 Also, dpkg supports them. 34779 3 n3npq 2013-07-23 11:37:45 +0000 The cited "invalid tag value" problem is a regular expression that can be modified: add "~" to the permitted characters in this macro %pattern_Version ^[A-Za-z0-9+._~]+$ in the macros file to permit a '~' in Version:. THe semantic changes to version comparison implied by twiddle-in-version have been implemented for more than a year and are present in rpm-5.4.10 (at least). Whether opkg/opkg-utils/dpkg "support" twiddle in version is largely irrelevant to rpm: rpm needs to be self-consistent with its own tool chains. Very few rpm tools are known to handle twiddle-in-version correctly. 34780 4 n3npq 2013-07-23 12:16:31 +0000 I'm also obligated by full disclosure to point out the reason (a CVE a few years back) why '~' (and other characters) were not included in rpm Version: strings. Many scripts/tools construct shell commands using values in metadata: rpmbuild is one of those tools, there are others. E.g. rpmbuild removes the build tree whose name is constructed from NVR tags in metadata. Consider this *.spec metadata: Name: N Version: V~whatever Release: R from which data rpmbuild constructs a command rm -rf N-V~whatever preparing for a build. All that is needed to trick rpmbuild into removing one's home directory is an alternative representation for a space character in some shell context surrounding the twiddle so that the command becomes rm -rf N-V ~ whatever A closely related exploit that appended ";rm -rf ~" to the Name: value (but using alternative representations of the ' ' character was reported to vendor-sec like 4 years ago 73057 5 ross.burton 2017-05-04 16:43:24 +0000 opkg-utils should now be using more shared code so is fixed. rpm4 supports it. I think we're close to closing this. 75505 6 ross.burton 2017-07-31 16:44:47 +0000 I've added a selftest that verifies that rpm, dpkg, and opkg all do the right thing with ~ in version comparisons, and a recipe that uses ~ builds correctly: $ find . -name test-version[-_]1* ./deb/corei7-64/test-version_1.0~beta-r0_amd64.deb ./ipk/corei7-64/test-version_1.0~beta-r0_corei7-64.ipk ./rpm/corei7_64/test-version-1.0~beta-r0.corei7_64.rpm