Subject: bug#40115: closed (Re: [bug#40115] [PATCH] download: Use correct system and guile in 'url-fetch/tarbomb' and 'url-fetch/zipbomb'.)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 08 Apr 2020 17:50:01 +0000

Your bug report

#40115: [PATCH] download: Use correct system and guile in 'url-fetch/tarbomb' and 'url-fetch/zipbomb'.

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
40115: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=40115
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: [bug#40115] [PATCH] download: Use correct system and guile in 'url-fetch/tarbomb' and 'url-fetch/zipbomb'.
From: Ludovic Courtès <[email-masked]>
To: Diego Nicola Barbato <[email-masked]>
Cc: [email-masked]
Date: Wed, 08 Apr 2020 19:49:05 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Diego,

Diego Nicola Barbato <[email-masked]> skribis:

>>>From 85594ce40c98ac5763b8295e2358567c6920188e Mon Sep 17 00:00:00 2001
> From: Diego Nicola Barbato <[email-masked]>
> Date: Mon, 16 Mar 2020 18:43:20 +0100
> Subject: [PATCH] download: Use correct system and guile in 'url-fetch/tarbomb'
>  and 'url-fetch/zipbomb'.
>
> Previously the result of `guix build -s $system $package' would depend on the
> system Guix was built for if $package or one of its dependencies used
> 'url-fetch/tarbomb' or 'url-fetch/zipbomb' as the origin method of its
> source (e.g. `guix build -s i686-linux ffmpeg' on i686-linux would build a
> different derivation than on x86_64-linux).
>
> This patch fixes this by explicitly passing the correct system and guile to
> 'gexp->derivation'.
>
> * guix/download.scm (url-fetch/tarbomb): Pass #:system system and
>   #:guile-for-build guile to 'gexp->derivation', where guile is the derivation
>   of guile for system.
>   (url-fetch/zipbomb): Likewise.

Good catch, pushed as c1d81df93d4b67671fc4a8e0a80c0f02c5821663!

>> builds a different derivation on i686-linux than on x86_64-linux.  This
>> doesn't just affect ffmpeg but a whole class of packages which use or
>> depend on a package that uses 'url-fetch/tarbomb' or 'url-fetch/zipbomb'
>> as the origin method of its source.  That's around 334 packages, among
>> them diffoscope, enlightenment, gnome, ungoogled-chromium, and wine.
>
> The number (348 for commit 151f3d4) and full list of affected packages
> can be computed by loading the attached script [0] into `guix repl' and
> running `(show-affected-packages)'.

Terrible that ci. has been building useless substitutes for these
packages and that users of non-x86_64 platforms were not getting
substitutes.

Thanks a lot for the patch and detailed analysis!

Ludo’.

Subject: [PATCH] download: Use correct system and guile in 'url-fetch/tarbomb' and 'url-fetch/zipbomb'.
From: Diego Nicola Barbato <[email-masked]>
To: [email-masked]
Date: Wed, 18 Mar 2020 13:05:31 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi Guix,

The attached patch fixes a bug where e.g.

  guix build -s i686-linux ffmpeg

builds a different derivation on i686-linux than on x86_64-linux.  This
doesn't just affect ffmpeg but a whole class of packages which use or
depend on a package that uses 'url-fetch/tarbomb' or 'url-fetch/zipbomb'
as the origin method of its source.  That's around 334 packages, among
them diffoscope, enlightenment, gnome, ungoogled-chromium, and wine.

The problem is fixed by explicitly passing the correct #:system and
#:guile-for-build to 'gexp->derivation' (as is done in other origin
methods such as 'git-fetch' or 'hg-fetch').

This shouldn't trigger any rebuils as it only affects the behaviour of
`guix build -s $system $package' if $system differs from the system type
of Guix itself.

Regards,

Diego

>From 85594ce40c98ac5763b8295e2358567c6920188e Mon Sep 17 00:00:00 2001
From: Diego Nicola Barbato <[email-masked]>
Date: Mon, 16 Mar 2020 18:43:20 +0100
Subject: [PATCH] download: Use correct system and guile in 'url-fetch/tarbomb'
 and 'url-fetch/zipbomb'.

Previously the result of `guix build -s $system $package' would depend on the
system Guix was built for if $package or one of its dependencies used
'url-fetch/tarbomb' or 'url-fetch/zipbomb' as the origin method of its
source (e.g. `guix build -s i686-linux ffmpeg' on i686-linux would build a
different derivation than on x86_64-linux).

This patch fixes this by explicitly passing the correct system and guile to
'gexp->derivation'.

* guix/download.scm (url-fetch/tarbomb): Pass #:system system and
  #:guile-for-build guile to 'gexp->derivation', where guile is the derivation
  of guile for system.
  (url-fetch/zipbomb): Likewise.
---
 guix/download.scm | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/guix/download.scm b/guix/download.scm
index 91a2b4ce5f..c3dc5a208c 100644
--- a/guix/download.scm
+++ b/guix/download.scm
@@ -531,7 +531,8 @@ own.  This helper makes it easier to deal with \"tar bombs\"."
                                       (string-append "tarbomb-"
                                                      (or name file-name))
                                       #:system system
-                                      #:guile guile)))
+                                      #:guile guile))
+                      (guile (package->derivation guile system)))
     ;; Take the tar bomb, and simply unpack it as a directory.
     ;; Use ungrafted tar/gzip so that the resulting tarball doesn't depend on
     ;; whether grafts are enabled.
@@ -544,6 +545,8 @@ own.  This helper makes it easier to deal with \"tar bombs\"."
                             (chdir #$output)
                             (invoke (string-append #$tar "/bin/tar")
                                     "xf" #$drv)))
+                      #:system system
+                      #:guile-for-build guile
                       #:graft? #f
                       #:local-build? #t)))
 
@@ -566,7 +569,8 @@ own.  This helper makes it easier to deal with \"zip bombs\"."
                                       (string-append "zipbomb-"
                                                      (or name file-name))
                                       #:system system
-                                      #:guile guile)))
+                                      #:guile guile))
+                      (guile (package->derivation guile system)))
     ;; Take the zip bomb, and simply unpack it as a directory.
     ;; Use ungrafted unzip so that the resulting tarball doesn't depend on
     ;; whether grafts are enabled.
@@ -578,6 +582,8 @@ own.  This helper makes it easier to deal with \"zip bombs\"."
                             (chdir #$output)
                             (invoke (string-append #$unzip "/bin/unzip")
                                     #$drv)))
+                      #:system system
+                      #:guile-for-build guile
                       #:graft? #f
                       #:local-build? #t)))
 
-- 
2.25.1