[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#971707: marked as done (lintian: breakout-link has lots of false positives, in particular for non-FHS trees below /usr/lib)

Your message dated Fri, 01 Oct 2021 08:55:04 +0000
with message-id <E1mWEJs-0005c3-IQ@fasolo.debian.org>
and subject line Bug#971707: fixed in lintian 2.107.0
has caused the Debian Bug report #971707,
regarding lintian: breakout-link has lots of false positives, in particular for non-FHS trees below /usr/lib
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
971707: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971707
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: lintian
Version: 2.97.0
Severity: normal

The new breakout-link tag (warning about symlinks escaping from /usr/lib)
seems to have a lot of false positives.

In particular, the pattern I'm interested in for this bug report
is that some upstream packages expect to be installed in a non-FHS
layout where a single directory mixes executables with libraries,
or mixes architecture-dependent executables and libraries with
architecture-independent data, or mixes configuration with static
files. This is very, very common in games, which are typically designed
to installed in an arbitrary relocatable directory of the user's choice.
It's also done in larger packages like OpenJDK and LibreOffice, in
GNUstep apps (each of which is designed to be self-contained directory),
and in many other packages.

The long-standing convention for dealing with these packages in Debian has
been to put their non-FHS tree in a subdirectory of /usr/lib. Files that
would ordinarily be valid to appear in /usr/lib are shipped there as
regular files, while files that would not be valid in /usr/lib are shipped
as symlinks to a regular file in another location. For example:

     usr/lib/openarena-server/baseoa/etc/openarena-server -> etc/openarena-server
     usr/lib/openarena-server/baseoa/pak0.pk3 -> usr/share/games/openarena/baseoa/pak0.pk3

Meanwhile, system integration (for example making the application appear
in /usr/share/applications and in /usr/bin) is done either via wrapper
scripts, or by moving or symlinking individual integration files.

I don't think it's a good idea to encourage maintainers to patch these
packages to use a FHS layout if their upstream would not accept that change.
Unnecessary delta from upstream increases the number of bugs that exist
only in Debian, leading to strained relations between upstreams and
downstreams; and changing the layout has no real benefit for our users in
cases like this, because we're installing the real files (such as
/etc/openarena-server/server.cfg and .../baseoa/pak0.pk3) in the locations
they should normally have.

The tag description says:

    At least for /usr/lib, it is usually an error and may confuse
    some tools.

[citation needed]? Which tools does it confuse, and which bugs does this
check catch? I don't think setting the level to warning is justified
unless a check genuinely prevents identifiable bugs.

The original bug #243158, back in 2003 (!), was specifically about
/usr/lib's role as the place where shared libraries are stored, which
has mostly been replaced by /usr/lib/<triplet> these days anyway. For
example, the original bug report seems to have been about having a
pattern something like this:

    /usr/lib/libbigloo.so.123 -> bigloo-1.2/libbigloo.so.123

I don't think the uses of /usr/lib in OpenArena, OpenJDK and LibreOffice
have anything to do with that pattern.

If there are concrete bugs that this tag is intended to detect, then I
suspect that would be better done by more narrowly-targeted tags.

Thanks,
    smcv

--- End Message ---
--- Begin Message --- 
Source: lintian
Source-Version: 2.107.0
Done: Chris Lamb <lamby@debian.org>

We believe that the bug you reported is fixed in the latest version of
lintian, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 971707@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated lintian package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 01 Oct 2021 08:28:20 +0000
Source: lintian
Architecture: source
Version: 2.107.0
Distribution: unstable
Urgency: medium
Maintainer: Debian Lintian Maintainers <lintian-maint@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Closes: 918137 968525 971707 994271 994414 994689 994711 994793 994902 995261
Changes:
 lintian (2.107.0) unstable; urgency=medium
 .
   * Summary of tag changes:
     + Added:
       - architecture-escape
       - control-interpreter-without-predepends
       - ldconfig-escape
       - runtime-test-file-uses-supported-python-versions-without-test-depends
     + Removed:
       - breakout-link
       - preinst-interpreter-without-predepends
       - runtime-test-file-uses-supported-python-versions-without-python-all-build-depends
 .
   [ Felix Lechner ]
   * Repurpose breakout-link; split into two new tags to find a use.
     (Closes: #968525, #971707)
   * Do not expect files in sudoers.d to have standard file permissions.
     (Closes: #995261)
   * Do not flag missing matches for Files-Excluded; uscan already got rid
     of them. (Closes: #994271)
   * Fix documentation for --fails-on command line option. (Closes: #994414)
   * Exempt empty packages so declared from empty-binary-package.
     (Closes: #994711)
   * Allow maintainer manual pages for executables also so provided.
     (Closes: #994689)
   * Only create diffstat when the diff.gz is mentioned in the dsc or the
     changes. (Closes: #994793)
   * Fix minimum version for init-system-helpers in a tag description.
     (Closes: #918137)
   * Be ambivalent between /lib and /usr/lib for systemd service files.
     (See: #992465)
   * Adopt latest style from website for the standalone HTML output often
     shown in Salsa CI.
   * Implement the multiarch selector :any in package relationships.
     (Closes: #994902)
 .
   [ Paul Wise ]
   * Revert "Upgrade superficial-tests tag to warning".
Checksums-Sha1:
 990323a8d6ad6ef78a1da399e8cc3dd66cff7c5f 2469 lintian_2.107.0.dsc
 e505eec7c5363b037328283ac2fb6e5173683947 2055384 lintian_2.107.0.tar.xz
 cd8d39e19500417d04a9edb57c5a2f05556ce883 6580 lintian_2.107.0_amd64.buildinfo
Checksums-Sha256:
 50761c017260f8d5db20206f871b1d857b4d901af84e70723c8b43434c168c8d 2469 lintian_2.107.0.dsc
 37878172115fed5a21657df8ab1fb908d62f60f24e414cce55d5f1b12f3c4515 2055384 lintian_2.107.0.tar.xz
 1d5a54efa3adda8d0d045bbd6626925a4ea928bd7827be583e0dedc30f3b5ca6 6580 lintian_2.107.0_amd64.buildinfo
Files:
 368b073b0038a00345f3ed39958a44b9 2469 devel optional lintian_2.107.0.dsc
 7e45f1deef8837445976f214c867b69b 2055384 devel optional lintian_2.107.0.tar.xz
 eba8e83b369ea47ba9580cddfc4a5573 6580 devel optional lintian_2.107.0_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmFWxwEACgkQHpU+J9Qx
HlgWcg//YWOdZ7+w3/c1wy0WxYm5+QoUm1jCHE2hlMRnkP4LjK5Nv7OLVvFltVxn
v3RKYOgYYbTJBId+oLpNTX92yXR4sSWzQqhYavAhOxSsySBRFurbRvavUY2OMf2O
N2FZ7wOAvm4jKaks9/iTvsAqeCfWDmTky5+/UQKA1va2IXQa0KLAZH8WN1U3NlaU
IRYWne1kdMkRZobcixDeWM2De2I5jSkizLNzZ5mUgqEsMDMtmzqh1tNcxOrvou2r
IpIy4Fm3DUn/iF8Pav7l8v7Lp+Vl0fFLia0h9/rP4aruVitFCpUzx34RdTfvO3oE
o83aEdv9zwNNU8RPyDB2bYi6c6ZnbyTh0qXF4+7A9PK2GDbL0jh0RTia4rHO/9nw
V0dLwepy2kvv0LHUO6Qb9R6E06TotwIfJ2mHRUJv8gHm1Hp0ZPmXFQ5Yl3lshKS3
lc9VFkFsggnJwvuXNtZF7z4MAE0DRxHEw8lxe010EguBYKK2h6r0Mchdxb7a2JqI
RTMn09iJbjq9ejgAvExu3l7sGbdkOUaoiEy9+vQXw0vxOi7FiFFwC68VgDgj5DTY
XTVNvmXMrbfLUbnNiuJElHjgH7+3nWbON9gTlvD/h7aQECSO2bkh1GgTkL7Hs8FR
r/pSv+Ag8qtM/ZYkEvum3wVT847VWTetMdvzFwMGqLRFeYApq5E=
=HUCi
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: