7620 2015-04-16 15:55:12 +0000 Poor validation of subpath= value in git fetcher leads to unexpected file deletions 2015-09-08 14:37:16 +0000 1 1 7 Build System, Metadata & Runtime BitBake bitbake 1.7 All Multiple VERIFIED FIXED High critical 1.9 M1 1 bluelightning bluelightning alexandru.c.georgescu anders.darander bogdanx.a.voiculescu poky.bs.watcher poky.watcher georgex.l.musat --- New (Never tested) No (bug/feature does not impact docs) oldest_to_newest 50358 0 bluelightning 2015-04-16 15:55:12 +0000 It seems that if you use the subpath= parameter in a git:// URI in SRC_URI and have / at the start or the end of the specified value, the result can be that files in your home directory get deleted: https://lists.yoctoproject.org/pipermail/yocto/2015-April/024552.html This is due to the git fetcher code improperly splitting and joining the path and then not validating the result, which is either / or somewhere else we shouldn't be touching, and then attempting to clean that location out prior to unpacking. 50359 1 bluelightning 2015-04-16 15:56:13 +0000 Additional note - this bug has probably been present since the subpath option was introduced; it's rarely used hence the reason why we haven't seen this issue before. 50373 2 anders.darander 2015-04-17 05:53:37 +0000 I've sent a simple patch for this, see http://lists.openembedded.org/pipermail/bitbake-devel/2015-April/005659.html. Sofar, I've not looked at whether a leading '/' in subpath can cause any issues later on. If so, that could be handled by adding .strip('/') on subpath in the line before the one I'm touching here. 50379 3 bluelightning 2015-04-17 11:06:38 +0000 OK, the above patch has been merged, thanks Anders. I'll send a follow-up today with additional checks. 50386 4 bluelightning 2015-04-17 14:38:03 +0000 Follow up patch with extra checks sent: http://lists.openembedded.org/pipermail/bitbake-devel/2015-April/005664.html 50466 5 bluelightning 2015-04-22 10:27:39 +0000 Where we are with this now - the aforementioned patches have been merged to master: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=65e985976989c30a94d6e78c8cb348af93fa0878 http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=72d88f29da1ece634028420317233a45ff8e015b The next step is to backport them to fido, dizzy, and daisy at minimum. 50512 6 bluelightning 2015-04-26 12:44:30 +0000 These fixes have now been backported to fido, dizzy and daisy. Marking as resolved. 53839 7 georgex.l.musat 2015-09-08 14:37:16 +0000 Verified on commit bc6a1a23e3d1af3861288a7abdbc9d5010470204.