Hi Stuart,
Quoting Stuart Prescott (2016-11-27 13:38:56)
> I assume we're not worried that if the local admin installs ccache, then the
> build will store files outside the build directory violating the prohibition
> that a 'required target must not attempt to write outside of the source
> package directory tree'.
that's a good point! But the current version of the patch only touches what is
and isn't allowed in the targets in debian/rules. Mechanisms like ccache work
implicitly without changes to debian/rules. Are you proposing to amend the
patch such that we also add a line saying:
Source packages must not require tools that implicitly preserve state during
multiple rebuilds through their build dependencies.
Somewhere in §4.2 maybe?
> > The required targets must not attempt to write outside of the source
> > package package directory tree. An exception to this rule is the use of
> > <file>/tmp</file> which is permitted as long as temporary files are deleted
> > and not re-used by subsequent execution of the target.
>
> I'd rather see TMPDIR described (rather than /tmp) as the location that can
> be used; /tmp should only be used if TMPDIR is not set.
Okay, addressed in the new version.
> As a very pedantic point, Policy elsewhere refers to environment variables as
> <tt>HOME</tt> -- that is, without the $. The $ is shell-specific syntax for
> parameter expansion, while the environment variable itself exists in other
> languages and the name does not include the $. Documentation of the
> environment such as environ(7) or the Open Group standards normally omits the
> $ as a result. (I can find only one use of $ in Policy outside shell/make
> snippets.)
Thanks, fixed as well. Here the new version:
The required targets must not attempt to write outside of the source
package package directory tree. An exception to this rule is the use of
<tt>TMPDIR</tt> which is permitted as long as temporary files are deleted
and not re-used by subsequent execution of the target. This restriction is
intended to prevent that source package builds creating and depending on
state outside of themselves and thus affect multiple independent rebuilds.
Most notably, the required targets must not attempt to write into
<tt>HOME</tt>.
cheers, josch
Attachment:
signature.asc
Description: signature