Bug 6549

Summary:	GNU Wget is required in buildtools-tarball.
Product:	[Yocto Project Subprojects] ADT	Reporter:	Tudor Florea <tudor.florea>
Component:	adt	Assignee:	Paul Eggleton <bluelightning>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Medium	CC:	poky.adt.watcher, poky.watcher, richard.purdie, sgw
Version:	1.6
Target Milestone:	1.7
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Done (doc changes complete)

Description Tudor Florea 2014-07-17 19:47:17 UTC

GNU Wget cannot be upgrated to a newer that 1.12 version on supported Contos distro.
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download. (A side effect of this can be exploited as per http://www.cvedetails.com/cve/CVE-2010-2252/).
In yocto environment, this means the files downloaded when fetching cannot be properly used:
$ wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz
$ ls
eventlog_0.2.13.tar.gz?AWSAccessKeyId=AKIAICTJ5MANGPMOH7JA&Expires=1400838672&Signature=TjakOBpOvHtEKKDgF14iVinWpY0=

This in turn lead to build errors like:

WARNING: Failed to fetch URL http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz, attempting MIRRORS if available
ERROR: Fetcher failure for URL: 'http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz&#39;. The fetch command returned success for url http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz but /path/to/downloads/eventlog_0.2.13.tar.gz doesn't exist?!
ERROR: Function failed: Fetcher failure for URL: 'http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz&#39;. Unable to fetch URL from any source.
ERROR: Logfile of failure stored in: /path/to/tmp/work/ppce500v2-enea-linux-gnuspe/eventlog/0.2.13-r0/temp/log.do_fetch.28302
ERROR: Task 4 (/path/to/poky/meta-openembedded/meta-oe/recipes-support/eventlog/eventlog_0.2.13.bb, do_fetch) failed with exit code '1'

Comment 1 Tudor Florea 2014-07-21 16:05:52 UTC

http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=0d34ed38a5893d0b68deb8a62ac4085f81db1dab

Comment 2 Richard Purdie 2014-07-24 14:36:38 UTC

Fix merged.

Comment 3 Tudor Florea 2014-07-24 14:43:55 UTC

I'm not sure about the process flow but I assume the inclusion of wget in the buildtools needs to be documented (in chapter 1.3.3. in Reference manual).

Comment 4 Paul Eggleton 2014-07-24 16:01:51 UTC

buildtools contains lots of things other than git, tar, and python, and I don't think it's going to be helpful to the user to document everything that is in it.

We should probably add an explicit pointer from the CentOS section to the buildtools, but to be fair when you look at the versions of git/tar/python in CentOS 6 it becomes pretty clear that you need the buildtools anyway.

Comment 5 Tudor Florea 2014-07-24 16:31:47 UTC

This is ok for me.

Comment 6 Paul Eggleton 2014-07-25 08:59:04 UTC

The "CentOS Packages" section of the reference manual has been updated as above in the dora, daisy and master branches, so I'm marking this as resolved.