Bug 3976

Summary:	Support ~ in package versions
Product:	[Build System, Metadata & Runtime] OE-Core	Reporter:	Richard Purdie <richard.purdie>
Component:	core	Assignee:	Unassigned <unassigned>
Status:	RESOLVED FIXED	QA Contact:
Severity:	enhancement
Priority:	Medium	CC:	jessica.zhang, meta.mr.watcher, meta.watcher, n3npq, ross.burton, sgw
Version:	1.4
Target Milestone:	Future
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Don't know

Description Richard Purdie 2013-03-04 12:15:52 UTC

We should support the ~ character in package versions. As far as I know the status is:

* Bitbake supports them
* opkg itself supports them since 2008: http://code.google.com/p/opkg/source/detail?spec=svn40&r=40
* opkg-utils doesn't (e.g. opkg-compare-versions)
* rpm packaging code does not 'invalid tag value("^[A-Za-z0-9+._]+$") Version: Version: 0.20~rc1+git0+fdb6c0402337d9607c7a39155088eaf033742752' from do_package_write_rpm
* Status of other parts of the system is unknown

Comment 1 Jeff Johnson 2013-04-24 16:34:17 UTC

Tracked at https://bugs.launchpad.net/rpm/+bug/1172341

Comment 2 Ross Burton 2013-07-23 10:36:35 UTC

Also, dpkg supports them.

Comment 3 Jeff Johnson 2013-07-23 11:37:45 UTC

The cited "invalid tag value" problem is a regular expression
that can be modified: add "~" to the permitted characters
in this macro
    %pattern_Version        ^[A-Za-z0-9+._~]+$
in the macros file to permit a '~' in Version:.

THe semantic changes to version comparison implied by
twiddle-in-version have been implemented for more than
a year and are present in rpm-5.4.10 (at least).

Whether opkg/opkg-utils/dpkg "support" twiddle in
version is largely irrelevant to rpm: rpm needs
to be self-consistent with its own tool chains.

Very few rpm tools are known to handle twiddle-in-version
correctly.

Comment 4 Jeff Johnson 2013-07-23 12:16:31 UTC

I'm also obligated by full disclosure to point out
the reason (a CVE a few years back) why '~' (and other
characters) were not included in rpm Version: strings.

Many scripts/tools construct shell commands using
values in metadata: rpmbuild is one of those tools,
there are others.

E.g. rpmbuild removes the build tree whose name is constructed
from NVR tags in metadata. Consider this *.spec metadata:
    Name: N
    Version: V~whatever
    Release: R
from which data rpmbuild constructs a command
    rm -rf N-V~whatever
preparing for a build.

All that is needed to trick rpmbuild into removing
one's home directory is an alternative representation
for a space character in some shell context surrounding
the twiddle so that the command becomes
    rm -rf N-V ~ whatever

A closely related exploit that appended ";rm -rf ~" to
the Name: value (but using alternative representations of
the ' ' character was reported to vendor-sec like 4 years ago

Comment 5 Ross Burton 2017-05-04 16:43:24 UTC

opkg-utils should now be using more shared code so is fixed.

rpm4 supports it.

I think we're close to closing this.

Comment 6 Ross Burton 2017-07-31 16:44:47 UTC

I've added a selftest that verifies that rpm, dpkg, and opkg all do the right thing with ~ in version comparisons, and a recipe that uses ~ builds correctly:

$ find . -name test-version[-_]1*
./deb/corei7-64/test-version_1.0~beta-r0_amd64.deb
./ipk/corei7-64/test-version_1.0~beta-r0_corei7-64.ipk
./rpm/corei7_64/test-version-1.0~beta-r0.corei7_64.rpm