Subject: Two libtool 2.4.6 issues

From: Sergey Poznyakoff <[email-masked]>
Date: Sat, 14 Dec 2019 13:23:33 +0200

Dear maintainers,

When working on GNU mailutils we have discovered two issues with libtool,
which probably qualify as bugs.

Issue 1:

Imagine a project consisting of at least one installable shared
library (libltb1) and an installable binary program (ltb1), which is
linked with that library. If the ltb1_LDFLAGS variable contains one
or more -Wl,-rpath linker options, the created wrapper script will
prefer directories listed in them over locations in the build tree. If
a previous version of the libltb1 library is already installed in one
of these directories, the ltb1 wrapper will use the installed version
of the library, instead of the one from the source tree. This leads to
undesirable consequences, e.g. if the package provides a test suite,
it will likely fail, since it will be using wrong library version.

This issue is described in detail here:

  http://gray.gnu.org.ua/public/ltbug/#ltb1

The test case is available for download from:

  http://gray.gnu.org.ua/public/ltbug/ltbug-1.tar.gz

(to test, unpack the archive and run 'sh ltbug-1/test.sh')
  
The proposed patch is available from:

  http://gray.gnu.org.ua/public/ltbug/0001-ltmain.in-append-rpath-option-arguments-to-finalize_.patch

Issue 2:

Imagine a project consisting of two installable libraries (liba, and
libb) and a binary (ltb2) linked to both of them. Let liba depend on an
external library, which has a libtool archive installed along with the
shared library.  This archive obviously contains the libdir variable
pointing to its installation directory (let's name it D).  Then, the
wrapper script for ltb2 is created in such a way, that liba is searched
in the source tree, but the libb is searched first in D and then in the
source tree. If a prior version of the project is installed in the same
prefix as the libdep library, then the ltb2 wrapper will use the version
of liba from the local source tree, but the version of libb installed on
the system.

This issue is described in detail in:

  http://gray.gnu.org.ua/public/ltbug/#ltb2

The test case is available for download from:

  http://gray.gnu.org.ua/public/ltbug/ltbug-2.tar.gz

(to test, unpack the archive and run 'sh ltbug-2/test.sh')  
  
The proposed patch is available here:

  http://gray.gnu.org.ua/public/ltbug/0002-ltmain.in-ensure-that-local-source-tree-directories-.patch

Both issues were confirmed to exist on GNU/Linux and on FreeBSD.  See
http://gray.gnu.org.ua/public/ltbug#affected-systems for a complete list
list.  Both libtool 2.4.6 and the development version from git HEAD
were tested.

Best regards,
Sergey