GNU bug report logs - #68333
Time bomb in icedtea/openjdk

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 68333 in the body.
You can then email your comments to 68333 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Julien Lepiller <julien <at> lepiller.eu>
To: bug-guix <at> gnu.org
Subject: Time bomb in icedtea/openjdk
Date: Mon, 8 Jan 2024 00:02:42 +0100

Hi Guix!

There seems to be a time bomb in icedtea <at> 2 and openjdk <at> 9. while
building it:

Error: time is more than 10 years from present: 1388527200000
java.lang.RuntimeException: time is more than 10 years from present:
1388527200000 at
build.tools.generatecurrencydata.GenerateCurrencyData.makeSpecialCaseEntry(GenerateCurrencyData.java:288)
at
build.tools.generatecurrencydata.GenerateCurrencyData.buildMainAndSpecialCaseTables(GenerateCurrencyData.java:227)
at
build.tools.generatecurrencydata.GenerateCurrencyData.main(GenerateCurrencyData.java:158)

I managed to work around that by setting the date back, but we should
investigate and fix it. icedtea <at> 3 doesn't seem to be affected.

Message #10 received at 68333 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Julien Lepiller <julien <at> lepiller.eu>
Cc: 68333 <at> debbugs.gnu.org
Subject: Re: bug#68333: Time bomb in icedtea/openjdk
Date: Tue, 09 Jan 2024 10:51:24 +0100

Hello!

Julien Lepiller <julien <at> lepiller.eu> skribis:

> There seems to be a time bomb in icedtea <at> 2 and openjdk <at> 9. while
> building it:
>
> Error: time is more than 10 years from present: 1388527200000
> java.lang.RuntimeException: time is more than 10 years from present:
> 1388527200000 at
> build.tools.generatecurrencydata.GenerateCurrencyData.makeSpecialCaseEntry(GenerateCurrencyData.java:288)
> at
> build.tools.generatecurrencydata.GenerateCurrencyData.buildMainAndSpecialCaseTables(GenerateCurrencyData.java:227)
> at
> build.tools.generatecurrencydata.GenerateCurrencyData.main(GenerateCurrencyData.java:158)
>
> I managed to work around that by setting the date back, but we should
> investigate and fix it. icedtea <at> 3 doesn't seem to be affected.

Confirmed:

  https://guix.bordeaux.inria.fr/build/432486/log

This is with Guix commit 7a7c8920aeddaf9ab8d68c572780bc34b404711b.

I couldn’t find ‘GenerateCurrencyData.java’ though, not sure where it
lives.

Ludo’.

Message #13 received at 68333 <at> debbugs.gnu.org (full text, mbox):

From: Rostislav Svoboda <rostislav.svoboda <at> gmail.com>
To: 68333 <at> debbugs.gnu.org
Subject: Re: Time bomb in icedtea/openjdk
Date: Tue, 9 Jan 2024 12:55:20 +0100

> I couldn’t find ‘GenerateCurrencyData.java’ though, not sure where it lives.

bost <at> ecke /tmp/guix-build-icedtea-2.6.13.drv-0$ fd GenerateCurrencyData.java
icedtea-2.6.13/openjdk/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
icedtea-2.6.13/openjdk-boot/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
icedtea-2.6.13/openjdk.src/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java

bost <at> ecke /tmp/guix-build-icedtea-2.6.13.drv-0$ fd
GenerateCurrencyData.java | xargs sha1sum
e819f2a934acca80a8eee42434459c70ad1bbf76
icedtea-2.6.13/openjdk/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
e819f2a934acca80a8eee42434459c70ad1bbf76
icedtea-2.6.13/openjdk-boot/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
e819f2a934acca80a8eee42434459c70ad1bbf76
icedtea-2.6.13/openjdk.src/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java

bost <at> ecke /tmp/guix-build-icedtea-2.6.13.drv-0$ rg -N -B 30 -A 12
'time is more than 10 years from present'
icedtea-2.6.13/openjdk.src/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
    private static int makeSpecialCaseEntry(String currencyInfo)
throws Exception {
        Integer oldEntry = specialCaseMap.get(currencyInfo);
        if (oldEntry != null) {
            return oldEntry.intValue();
        }
        if (specialCaseCount == maxSpecialCases) {
            throw new RuntimeException("too many special cases");
        }
        if (currencyInfo.length() == 3) {
            checkCurrencyCode(currencyInfo);
            specialCaseCutOverTimes[specialCaseCount] = Long.MAX_VALUE;
            specialCaseOldCurrencies[specialCaseCount] = currencyInfo;
            specialCaseOldCurrenciesDefaultFractionDigits[specialCaseCount]
= getDefaultFractionDigits(currencyInfo);
            specialCaseOldCurrenciesNumericCode[specialCaseCount] =
getNumericCode(currencyInfo);
            specialCaseNewCurrencies[specialCaseCount] = null;
            specialCaseNewCurrenciesDefaultFractionDigits[specialCaseCount] = 0;
            specialCaseNewCurrenciesNumericCode[specialCaseCount] = 0;
        } else {
            int length = currencyInfo.length();
            if (currencyInfo.charAt(3) != ';' ||
                    currencyInfo.charAt(length - 4) != ';') {
                throw new RuntimeException("invalid currency info: " +
currencyInfo);
            }
            String oldCurrency = currencyInfo.substring(0, 3);
            String newCurrency = currencyInfo.substring(length - 3, length);
            checkCurrencyCode(oldCurrency);
            checkCurrencyCode(newCurrency);
            String timeString = currencyInfo.substring(4, length - 4);
            long time = format.parse(timeString).getTime();
            if (Math.abs(time - System.currentTimeMillis()) > ((long)
10) * 365 * 24 * 60 * 60 * 1000) {
                throw new RuntimeException("time is more than 10 years
from present: " + time);
            }
            specialCaseCutOverTimes[specialCaseCount] = time;
            specialCaseOldCurrencies[specialCaseCount] = oldCurrency;
            specialCaseOldCurrenciesDefaultFractionDigits[specialCaseCount]
= getDefaultFractionDigits(oldCurrency);
            specialCaseOldCurrenciesNumericCode[specialCaseCount] =
getNumericCode(oldCurrency);
            specialCaseNewCurrencies[specialCaseCount] = newCurrency;
            specialCaseNewCurrenciesDefaultFractionDigits[specialCaseCount]
= getDefaultFractionDigits(newCurrency);
            specialCaseNewCurrenciesNumericCode[specialCaseCount] =
getNumericCode(newCurrency);
        }
        specialCaseMap.put(currencyInfo, new Integer(specialCaseCount));
        return specialCaseCount++;
    }

Message #16 received at 68333 <at> debbugs.gnu.org (full text, mbox):

From: Rostislav Svoboda <rostislav.svoboda <at> gmail.com>
To: 68333 <at> debbugs.gnu.org
Subject: Re: Time bomb in icedtea/openjdk
Date: Tue, 9 Jan 2024 22:00:49 +0100

[Message part 1 (text/plain, inline)]

Please try this patch.
Cheers Bost

[Message part 2 (text/html, inline)]

[0001-gnu-Fix-time-bomb-preventing-build-of-icedtea.patch (text/x-patch, attachment)]

Message #19 received at 68333 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Rostislav Svoboda <rostislav.svoboda <at> gmail.com>
Cc: 68333 <at> debbugs.gnu.org
Subject: Re: bug#68333: Time bomb in icedtea/openjdk
Date: Wed, 10 Jan 2024 15:35:00 +0100

[Message part 1 (text/plain, inline)]

Hi,

Rostislav Svoboda <rostislav.svoboda <at> gmail.com> skribis:

> From 1e86e32825a5025b4ef439e7f678143416f622b5 Mon Sep 17 00:00:00 2001
> Message-ID: <1e86e32825a5025b4ef439e7f678143416f622b5.1704815654.git.Rostislav.Svoboda <at> gmail.com>
> From: Rostislav Svoboda <Rostislav.Svoboda <at> gmail.com>
> Date: Tue, 9 Jan 2024 14:08:02 +0100
> Subject: [PATCH] gnu: Fix time bomb preventing build of icedtea.
>
> Fixes <https://issues.guix.gnu.org/68333>.
>
> Fixes time bomb preventing build of icedtea by patching the java source code
> so that the java-RuntimeException is not thrown when 'more than 10 years ago'
> condition is true.
>
> * gnu/packages/java.scm (icedtea): Patch java source code so that the
> offending line is commented out.
>
> Change-Id: I4861ee2ffc5aaffb6a9244110d222ae64bfbdf94

Thanks for the quick investigation and patch!  I just realized that this
affects current ‘master’ so we’d rather fix it soon.

What do you think of the attached patch?  The difference is that it
patches code at its root (in the actual source tarball rather than after
it’s been copied), it does so for IcedTea 7 and 8, and there are patch
files that are slightly clearer than a substitution pattern.

It’s still building on my machine but if it works for everyone, I’d like
to push as soon as I got it built.

Ludo’.

[0001-gnu-icedtea-Fix-time-bomb-in-GenerateCurrencyData.ja.patch (text/x-patch, inline)]

From 92561a776ad88eb73034948beedbe9e6be4077b4 Mon Sep 17 00:00:00 2001
Message-ID: <92561a776ad88eb73034948beedbe9e6be4077b4.1704897216.git.ludo <at> gnu.org>
From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= <ludo <at> gnu.org>
Date: Wed, 10 Jan 2024 15:27:47 +0100
Subject: [PATCH] =?UTF-8?q?gnu:=20icedtea:=20Fix=20time=20bomb=20in=20?=
 =?UTF-8?q?=E2=80=98GenerateCurrencyData.java=E2=80=99.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes <https://issues.guix.gnu.org/68333>.

* gnu/packages/java.scm (icedtea-7)[drop]: Add optional ‘patches’
parameter and honor it.
[native-inputs]: Add patch for “jdk-drop”.
(icedtea-8): Likewise.
* gnu/packages/patches/jdk-currency-time-bomb.patch,
gnu/packages/patches/jdk-currency-time-bomb2.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.

Change-Id: I3b4cf562ce4bedb87ce0e7c289e431fbb0dbb6f8
---
 gnu/local.mk                                     |  2 ++
 gnu/packages/java.scm                            | 16 ++++++++++------
 .../patches/jdk-currency-time-bomb.patch         | 13 +++++++++++++
 .../patches/jdk-currency-time-bomb2.patch        | 13 +++++++++++++
 4 files changed, 38 insertions(+), 6 deletions(-)
 create mode 100644 gnu/packages/patches/jdk-currency-time-bomb.patch
 create mode 100644 gnu/packages/patches/jdk-currency-time-bomb2.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 16a34065c6..22970932e9 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1478,6 +1478,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/java-xerces-build_dont_unzip.patch	\
   %D%/packages/patches/java-xerces-xjavac_taskdef.patch	\
   %D%/packages/patches/jbr-17-xcursor-no-dynamic.patch	\
+  %D%/packages/patches/jdk-currency-time-bomb.patch		\
+  %D%/packages/patches/jdk-currency-time-bomb2.patch		\
   %D%/packages/patches/jfsutils-add-sysmacros.patch		\
   %D%/packages/patches/jfsutils-gcc-compat.patch		\
   %D%/packages/patches/jfsutils-include-systypes.patch		\
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index e2c2a041a9..ded73bc461 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -100,13 +100,14 @@ (define-module (gnu packages java)
 
 (define-public icedtea-7
   (let* ((version "2.6.13")
-         (drop (lambda (name hash)
+         (drop (lambda* (name hash #:optional (patches '()))
                  (origin
                    (method url-fetch)
                    (uri (string-append
                          "http://icedtea.classpath.org/download/drops"
                          "/icedtea7/" version "/" name ".tar.bz2"))
-                   (sha256 (base32 hash))))))
+                   (sha256 (base32 hash))
+                   (patches patches)))))
     (package
       (name "icedtea")
       (version version)
@@ -614,7 +615,8 @@ (define-public icedtea-7
                  "110j7jlz47x2gg6f7653x12mssan5kvj9l9h1m1c8c92drfxbqyk"))
          ("jdk-drop"
           ,(drop "jdk"
-                 "0d1mca38ksxvdskp9im3pp7fdijhj1n3lwq9w13r9s4v3qyskgdd"))
+                 "0d1mca38ksxvdskp9im3pp7fdijhj1n3lwq9w13r9s4v3qyskgdd"
+                 (search-patches "jdk-currency-time-bomb.patch")))
          ("langtools-drop"
           ,(drop "langtools"
                  "0nq5236fzxn3p6x8cgncl56mzcmsj07q9gymysnws4c8byc6n0qj"))
@@ -687,13 +689,14 @@ (define-public icedtea-7
 
 (define-public icedtea-8
   (let* ((version "3.19.0")
-         (drop (lambda (name hash)
+         (drop (lambda* (name hash #:optional (patches '()))
                  (origin
                    (method url-fetch)
                    (uri (string-append
                          "http://icedtea.classpath.org/download/drops"
                          "/icedtea8/" version "/" name ".tar.xz"))
-                   (sha256 (base32 hash))))))
+                   (sha256 (base32 hash))
+                   (patches patches)))))
     (package (inherit icedtea-7)
       (version "3.19.0")
       (source (origin
@@ -839,7 +842,8 @@ (define-public icedtea-8
                  "1pc0pv4v2mn2mjc0vp19d94v2150xigyhxsmckqasy647zcm6w0r"))
          ("jdk-drop"
           ,(drop "jdk"
-                 "1742lcm55l8zhi522x83v65ccr0rd6511q9rj7crw44x3ymdrhrv"))
+                 "1742lcm55l8zhi522x83v65ccr0rd6511q9rj7crw44x3ymdrhrv"
+                 (search-patches "jdk-currency-time-bomb2.patch")))
          ("langtools-drop"
           ,(drop "langtools"
                  "08iz7p2xcddlphipf6gahyabr5cawlnydap12p1n4f0md069b50b"))
diff --git a/gnu/packages/patches/jdk-currency-time-bomb.patch b/gnu/packages/patches/jdk-currency-time-bomb.patch
new file mode 100644
index 0000000000..8e6bce6fcd
--- /dev/null
+++ b/gnu/packages/patches/jdk-currency-time-bomb.patch
@@ -0,0 +1,13 @@
+Fix a time bomb present in the jdk "drop" of IcedTea.
+
+--- a/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
++++ b/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
+@@ -284,7 +284,7 @@ public class GenerateCurrencyData {
+             String timeString = currencyInfo.substring(4, length - 4);
+             long time = format.parse(timeString).getTime();
+             if (Math.abs(time - System.currentTimeMillis()) > ((long) 10) * 365 * 24 * 60 * 60 * 1000) {
+-                throw new RuntimeException("time is more than 10 years from present: " + time);
++                System.err.println("note: time is more than 10 years from \"present\": " + time);
+             }
+             specialCaseCutOverTimes[specialCaseCount] = time;
+             specialCaseOldCurrencies[specialCaseCount] = oldCurrency;
diff --git a/gnu/packages/patches/jdk-currency-time-bomb2.patch b/gnu/packages/patches/jdk-currency-time-bomb2.patch
new file mode 100644
index 0000000000..94454626c4
--- /dev/null
+++ b/gnu/packages/patches/jdk-currency-time-bomb2.patch
@@ -0,0 +1,13 @@
+Fix a time bomb present in the jdk "drop" of IcedTea 8.
+
+--- a/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
++++ b/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
+@@ -284,7 +284,7 @@ public class GenerateCurrencyData {
+             String timeString = currencyInfo.substring(4, length - 4);
+             long time = format.parse(timeString).getTime();
+             if (Math.abs(time - System.currentTimeMillis()) > ((long) 10) * 365 * 24 * 60 * 60 * 1000) {
+-                throw new RuntimeException("time is more than 10 years from present: " + time);
++                System.err.println("note: time is more than 10 years from \"present\": " + time);
+             }
+             specialCaseCutOverTimes[specialCaseCount] = time;
+             specialCaseOldCurrencies[specialCaseCount] = oldCurrency;

base-commit: 3eac1c82f7f1547aa6819db867b071a4ee7de8e3
-- 
2.41.0

Message #24 received at 68333-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Rostislav Svoboda <rostislav.svoboda <at> gmail.com>
Cc: 68333-done <at> debbugs.gnu.org
Subject: Re: bug#68333: Time bomb in icedtea/openjdk
Date: Wed, 10 Jan 2024 17:30:05 +0100

Ludovic Courtès <ludo <at> gnu.org> skribis:

>>From 92561a776ad88eb73034948beedbe9e6be4077b4 Mon Sep 17 00:00:00 2001
> Message-ID: <92561a776ad88eb73034948beedbe9e6be4077b4.1704897216.git.ludo <at> gnu.org>
> From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= <ludo <at> gnu.org>
> Date: Wed, 10 Jan 2024 15:27:47 +0100
> Subject: [PATCH] =?UTF-8?q?gnu:=20icedtea:=20Fix=20time=20bomb=20in=20?=
>  =?UTF-8?q?=E2=80=98GenerateCurrencyData.java=E2=80=99.?=
> MIME-Version: 1.0
> Content-Type: text/plain; charset=UTF-8
> Content-Transfer-Encoding: 8bit
>
> Fixes <https://issues.guix.gnu.org/68333>.
>
> * gnu/packages/java.scm (icedtea-7)[drop]: Add optional ‘patches’
> parameter and honor it.
> [native-inputs]: Add patch for “jdk-drop”.
> (icedtea-8): Likewise.
> * gnu/packages/patches/jdk-currency-time-bomb.patch,
> gnu/packages/patches/jdk-currency-time-bomb2.patch: New files.
> * gnu/local.mk (dist_patch_DATA): Add them.
>
> Change-Id: I3b4cf562ce4bedb87ce0e7c289e431fbb0dbb6f8

Pushed as 5c0f77f4241c9beac0c82deae946bfdc70b49ff0.

Let’s hope there’s no similar time bomb elsewhere in the Java stack.

Thanks again,
Ludo’.

Message #27 received at 68333-done <at> debbugs.gnu.org (full text, mbox):

From: Rostislav Svoboda <rostislav.svoboda <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 68333-done <at> debbugs.gnu.org
Subject: Re: bug#68333: Time bomb in icedtea/openjdk
Date: Wed, 10 Jan 2024 22:00:16 +0100

Hi,

> What do you think of the attached patch?  The difference is that it
> patches code at its root (in the actual source tarball rather than after
> it’s been copied), it does so for IcedTea 7 and 8, and there are patch
> files that are slightly clearer than a substitution pattern.

That's clearly a much better solution than that substitution pattern of mine.

Besides, I missed the path difference:
  jdk-3.19.0-2d5d2c77faa3:
/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
  jdk-2.6.13-68b6bb380175:
/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java

Speaking of which, I'd go for e.g.:
  jdk-3.19.0-currency-time-bomb.patch
  jdk-2.6.13-currency-time-bomb.patch
instead of:
  jdk-currency-time-bomb.patch
  jdk-currency-time-bomb2.patch

Yeah naming is hard ;-)

Also, changing the error string from:
  time is more than 10 years from present
to:
  time is more than 10 years from \"present\"

i.e. adding double quotes will slightly complicate googling for that
error message in the future.

> Pushed as 5c0f77f4241c9beac0c82deae946bfdc70b49ff0.

Thanks

> Let’s hope there’s no similar time bomb elsewhere in the Java stack.

I'm looking aaaand... I haven't found anything so far.

Cheers Bost

Message #30 received at 68333 <at> debbugs.gnu.org (full text, mbox):

From: Simon Tournier <zimon.toutoune <at> gmail.com>
To: Ludovic Courtès <ludo <at> gnu.org>, Rostislav Svoboda
 <rostislav.svoboda <at> gmail.com>
Cc: 68333 <at> debbugs.gnu.org
Subject: Re: bug#68333: Time bomb in icedtea/openjdk
Date: Thu, 18 Jan 2024 12:10:40 +0100

Hi,

Thanks all for the quick fix.

Well, I am asking here but maybe such discussion would deserve its own
thread on guix-devel. :-)

On mer., 10 janv. 2024 at 15:35, Ludovic Courtès <ludo <at> gnu.org> wrote:

> Thanks for the quick investigation and patch!  I just realized that this
> affects current ‘master’ so we’d rather fix it soon.
>
> What do you think of the attached patch?  The difference is that it
> patches code at its root (in the actual source tarball rather than after
> it’s been copied), it does so for IcedTea 7 and 8, and there are patch
> files that are slightly clearer than a substitution pattern.

This fixes the future but not the past.  Hum, headache with guix
time-machine?  :-)

The question is twofold:

 1. Do we document that some Java stack is broken for “guix
    time-machine”?  Other said, have we an evaluation about which Guix
    revisions are broken for the stack of Java?

 2. Do we provide a “transformation” for fixing such break?  Something
    that rewrite on the fly the origin for patching it; accessible only
    via manifest.

WDYT?

Cheers,
simon

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.