Bug 6549 - GNU Wget is required in buildtools-tarball.
Summary: GNU Wget is required in buildtools-tarball.
Status: RESOLVED FIXED
Alias: None
Product: ADT
Classification: Yocto Project Subprojects
Component: adt (show other bugs)
Version: 1.6
Hardware: x86 Multiple
: Medium normal
Target Milestone: 1.7
Assignee: Paul Eggleton
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2014-07-17 19:47 UTC by Tudor Florea
Modified: 2014-07-25 08:59 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Done (doc changes complete)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tudor Florea 2014-07-17 19:47:17 UTC 
GNU Wget cannot be upgrated to a newer that 1.12 version on supported Contos distro.
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download. (A side effect of this can be exploited as per http://www.cvedetails.com/cve/CVE-2010-2252/).
In yocto environment, this means the files downloaded when fetching cannot be properly used:
$ wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz
$ ls
eventlog_0.2.13.tar.gz?AWSAccessKeyId=AKIAICTJ5MANGPMOH7JA&Expires=1400838672&Signature=TjakOBpOvHtEKKDgF14iVinWpY0=

This in turn lead to build errors like:

WARNING: Failed to fetch URL http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz, attempting MIRRORS if available
ERROR: Fetcher failure for URL: 'http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz'. The fetch command returned success for url http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz but /path/to/downloads/eventlog_0.2.13.tar.gz doesn't exist?!
ERROR: Function failed: Fetcher failure for URL: 'http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.4.2/source/eventlog_0.2.13.tar.gz'. Unable to fetch URL from any source.
ERROR: Logfile of failure stored in: /path/to/tmp/work/ppce500v2-enea-linux-gnuspe/eventlog/0.2.13-r0/temp/log.do_fetch.28302
ERROR: Task 4 (/path/to/poky/meta-openembedded/meta-oe/recipes-support/eventlog/eventlog_0.2.13.bb, do_fetch) failed with exit code '1'
Comment 2 Richard Purdie 2014-07-24 14:36:38 UTC 
Fix merged.
Comment 3 Tudor Florea 2014-07-24 14:43:55 UTC 
I'm not sure about the process flow but I assume the inclusion of wget in the buildtools needs to be documented (in chapter 1.3.3. in Reference manual).
Comment 4 Paul Eggleton 2014-07-24 16:01:51 UTC 
buildtools contains lots of things other than git, tar, and python, and I don't think it's going to be helpful to the user to document everything that is in it.

We should probably add an explicit pointer from the CentOS section to the buildtools, but to be fair when you look at the versions of git/tar/python in CentOS 6 it becomes pretty clear that you need the buildtools anyway.
Comment 5 Tudor Florea 2014-07-24 16:31:47 UTC 
This is ok for me.
Comment 6 Paul Eggleton 2014-07-25 08:59:04 UTC 
The "CentOS Packages" section of the reference manual has been updated as above in the dora, daisy and master branches, so I'm marking this as resolved.