| Summary: | lsb_release output should be sanitised before usage | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Sascha Silbe <silbe> |
| Component: | core | Assignee: | Ross Burton <ross.burton> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Undecided | CC: | meta.mr.watcher, meta.watcher |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
For testing, what distribution is known to be broken like this? Specifically, if we ran the distribution name through re.sub(r'\W', '', name) so that everything apart from numbers and letters were removed, would that fix the problem without causing other issues? Can you see if this patch works for you? http://patchwork.openembedded.org/patch/120135/ Merged in oe-core 8a96a7207561e00eb92e4fb69e7340f20bfa2053. I haven't tried the patch yet, but running the regex replacement on the problematic lsb_release output sanitised the name properly (as expected). Thanks! |
Some downstream distributions use special characters in some of the lsb_release output fields. That's unusual, but not expressly forbidden by the LSB specification [1]. poky currently uses the output of "lsb_release -ir" more or less as-is for generating some paths (e.g. SSTATE_EXTRAPATH). Since many parts of poky (including most recipes) don't properly quote / escape paths, this causes the build to fail horribly. The distro name should be sanitised to only contain characters that cannot cause any trouble when used unquoted ("whitelist" approach). The existing replacements in meta/lib/oe/lsb.py only cover two specific cases ("blacklist" approach). Encountered with fido (in my case the distribution id contained double quotes), but the code in master looks very similar. [1] https://refspecs.linuxfoundation.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/lsbrelease.html