You are not logged in.
I am attempting to build and install the ds9 8.5-1 package from AUR. The build process completely successfully, but the following warning was given at the end:
==> Checking for packaging issues...
==> WARNING: Package contains reference to $srcdir
usr/bin/ds9I found this post explaining a similar problem for a different package, with these relevant responses:
It means the $srcdir path is contained somewhere inside the finished package, this is usually in the form of debug info or something. This is bad for reproducible builds but doesn't really effect anything else.
... This may be benign, or it may be the case that it tries to write important information to e.g. /home/alex/builds/pwsafe/src/pwsafe (regardless of who runs it)
... you're probably best off examining the src folder for any hardcoded reference to it's path and finding out what that reference is used for.
Following advice from the above post, I ran the following commands from within my build directory (/tmp/makepkg/ds9):
+[ds9]$ grep -rF "$(pwd -P)" ./pkg/ds9/usr/bin/ds9
grep: ./pkg/ds9/usr/bin/ds9: binary file matches+[ds9]$ strings ./pkg/ds9/usr/bin/ds9 | grep -F "$(pwd -P)"
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tk8.6/unix/../generic/tkBind.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tk8.6/unix/../generic/tkCanvUtil.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tcl8.6/generic/tclBasic.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tcl8.6/generic/tclCompile.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tcl8.6/generic/tclExecute.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tcl8.6/generic/tclIO.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tcl8.6/generic/tclParse.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/tcl8.6/generic/tclPathObj.c
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/bin
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib/tcl8.6
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/include
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/man
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib:.
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/ssl/private
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/ssl
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/ssl/certs
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/ssl/cert.pem
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib/engines
lappend dirs /tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib/tktable2.10
{/tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib}
/tmp/makepkg/ds9/src/SAOImageDS9-8.5/lib/tcl8.6I'm not too sure whether this is enough to determine that this instance of referencing $srcdir falls in the benign category, and that I'm okay to continue with installing the package, or if I need to do some further digging.
Thank you for your time.
Last edited by fractal_sounds (2023-09-26 14:30:46)
Offline
Most of the time is used for debug info as said, but you need to look at the source code to be certain.
Offline
Does not even build for me in a clean chroot without disabling buildflags:
make[3]: Entering directory '/build/ds9/src/SAOImageDS9-8.5/openssl/test'
( :; LIBDEPS="${LIBDEPS:--L.. -lssl -L.. -lcrypto -ldl}"; LDCMD="${LDCMD:-gcc}"; LDFLAGS="${LDFLAGS:--DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM}"; LIBPATH=`for x in $LIBDEPS; do echo $x; done | sed -e 's/^ *-L//;t' -e d | uniq`; LIBPATH=`echo $LIBPATH | sed -e 's/ /:/g'`; LD_LIBRARY_PATH=$LIBPATH:$LD_LIBRARY_PATH ${LDCMD} ${LDFLAGS} -o ${APPNAME:=wp_test} wp_test.o ${LIBDEPS} )
make[3]: Entering directory '/build/ds9/src/SAOImageDS9-8.5/openssl/test'
( :; LIBDEPS="${LIBDEPS:--L.. -lssl -L.. -lcrypto -ldl}"; LDCMD="${LDCMD:-gcc}"; LDFLAGS="${LDFLAGS:--DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM}"; LIBPATH=`for x in $LIBDEPS; do echo $x; done | sed -e 's/^ *-L//;t' -e d | uniq`; LIBPATH=`echo $LIBPATH | sed -e 's/ /:/g'`; LD_LIBRARY_PATH=$LIBPATH:$LD_LIBRARY_PATH ${LDCMD} ${LDFLAGS} -o ${APPNAME:=rc2test} rc2test.o ${LIBDEPS} )
gcc -DMONOLITH -I.. -I../include -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -c -o pkey.o pkey.c
/usr/bin/ld: ../libcrypto.a(x_all.o): warning: relocation against `X509_CRL_it' in read-only section `.text'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAME_set0_othername':
v3_genn.c:(.text+0x32b): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `OTHERNAME_new':
v3_genn.c:(.text+0x48): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `OTHERNAME_free':
v3_genn.c:(.text+0x58): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `EDIPARTYNAME_new':
v3_genn.c:(.text+0x88): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `EDIPARTYNAME_free':
v3_genn.c:(.text+0x98): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAME_new':
v3_genn.c:(.text+0xa8): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAME_free':
v3_genn.c:(.text+0xb8): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAMES_new':
v3_genn.c:(.text+0xe8): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAMES_free':
v3_genn.c:(.text+0xf8): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o):(.data.rel.ro+0xc0): undefined reference to `X509_NAME_itmake[3]: Leaving directory '/build/ds9/src/SAOImageDS9-8.5/openssl/test'
'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_add_entry':
x509name.c:(.text+0x4be): undefined reference to `X509_NAME_ENTRY_dup'
/usr/bin/ld: /usr/bin/ld: ../libcrypto.a(x_all.o): warning: relocation against `X509_CRL_it' in read-only section `.text'
x509name.c:(.text+0x573): undefined reference to `X509_NAME_ENTRY_dup'
/usr/bin/ld: x509name.c:(.text+0x61d): undefined reference to `make[3]: Entering directory '/build/ds9/src/SAOImageDS9-8.5/openssl/test'
( :; LIBDEPS="${LIBDEPS:--L.. -lssl -L.. -lcrypto -ldl}"; LDCMD="${LDCMD:-gcc}"; LDFLAGS="${LDFLAGS:--DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM}"; LIBPATH=`for x in $LIBDEPS; do echo $x; done | sed -e 's/^ *-L//;t' -e d | uniq`; LIBPATH=`echo $LIBPATH | sed -e 's/ /:/g'`; LD_LIBRARY_PATH=$LIBPATH:$LD_LIBRARY_PATH ${LDCMD} ${LDFLAGS} -o ${APPNAME:=rc4test} rc4test.o ${LIBDEPS} )
X509_NAME_ENTRY_free'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_ENTRY_create_by_txt':
x509name.c:(.text+0x6ad): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0x6d1): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_ENTRY_create_by_NID':
x509name.c:(.text+0x887/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAME_set0_othername':
v3_genn.c:(.text+0x32b): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `OTHERNAME_new':
v3_genn.c:(.text+0x48): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `OTHERNAME_free':
v3_genn.c:(.text+0x58): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `EDIPARTYNAME_new':
v3_genn.c:(.text+0x88): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `EDIPARTYNAME_free':
v3_genn.c:(.text+0x98): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAME_new':
v3_genn.c:(.text+0xa8): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAME_free':
v3_genn.c:(.text+0xb8): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAMES_new':
v3_genn.c:(.text+0xe8): undefined reference to `ASN1_item_new'
/usr/bin/ld: ../libcrypto.a(v3_genn.o): in function `GENERAL_NAMES_free':
v3_genn.c:(.text+0xf8): undefined reference to `ASN1_item_free'
/usr/bin/ld: ../libcrypto.a(v3_genn.o):(.data.rel.ro+0xc0): undefined reference to `X509_NAME_it'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_add_entry':
x509name.c:(.text+0x4be): undefined reference to `X509_NAME_ENTRY_dup'
/usr/bin/ld: x509name.c:(.text+0x573): undefined reference to `X509_NAME_ENTRY_dup'
/usr/bin/ld: x509name.c:(.text+0x61d): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_ENTRY_create_by_txt':
x509name.c:(.text+0x6ad): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0x6d1): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_ENTRY_create_by_NID':
x509name.c:(.text+0x887): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0x8b1): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_ENTRY_create_by_OBJ':
x509name.c:(.text+0xa5c): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0xad9): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_add_entry_by_OBJ':
x509name.c:(.text+0xcf2): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: x509name.c:(.text+0xd4e): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0xd8d): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_add_entry_by_NID':
x509name.c:(.text+0xdd2): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: x509name.c:(.text+0xe2d): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0xe4c): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: ../libcrypto.a(x509name.o): in function `X509_NAME_add_entry_by_txt':
x509name.c:(.text+0xec8): undefined reference to `X509_NAME_ENTRY_new'
/usr/bin/ld: x509name.c:(.text+0xf23): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: x509name.c:(.text+0xf44): undefined reference to `X509_NAME_ENTRY_free'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509at_add1_attr':
x509_att.c:(.text+0x1df): undefined reference to `X509_ATTRIBUTE_dup'
/usr/bin/ld: x509_att.c:(.text+0x27d): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509_ATTRIBUTE_create_by_OBJ':
x509_att.c:(.text+0x701): undefined reference to `X509_ATTRIBUTE_new'
/usr/bin/ld: x509_att.c:(.text+0x759): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: x509_att.c:(.text+0x761): undefined reference to `X509_ATTRIBUTE_new'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509at_add1_attr_by_OBJ':
x509_att.c:(.text+0x7ee): undefined reference to `X509_ATTRIBUTE_new'
/usr/bin/ld: x509_att.c:(.text+0x805): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: x509_att.c:(.text+0x84a): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509at_add1_attr_by_NID':
x509_att.c:(.text+0x8be): undefined reference to `X509_ATTRIBUTE_new'
/usr/bin/ld: x509_att.c:(.text+0x908): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: x509_att.c:(.text+0x924): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509at_add1_attr_by_txt':
x509_att.c:(.text+0x9c4): undefined reference to `X509_ATTRIBUTE_new'
/usr/bin/ld: x509_att.c:(.text+0xa16): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: x509_att.c:(.text+0xa34): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509_ATTRIBUTE_create_by_NID':
x509_att.c:(.text+0xb4f): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: x509_att.c:(.text+0xb61): undefined reference to `X509_ATTRIBUTE_new'
/usr/bin/ld: ../libcrypto.a(x509_att.o): in function `X509_ATTRIBUTE_create_by_txt':
x509_att.c:(.text+0xca7): undefined reference to `X509_ATTRIBUTE_free'
/usr/bin/ld: x509_att.c:(.text+0xcb1): undefined reference to `X509_ATTRIBUTE_new'
gcc -DMONOLITH -I.. -I../include -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -m64 -DL_ENDIAN -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -c -o pkeyparam.o pkeyparam.c
make[3]: Leaving directory '/build/ds9/src/SAOImageDS9-8.5/openssl/test'Offline
Most of the time is used for debug info as said, but you need to look at the source code to be certain.
Thank you for the response. Would you by any chance be able to point me towards some resources for learning more about this? While I do have coding/scripting knowledge, I don't have enough experience with large-scale building/compiling to know what it is I actually need to be looking for here.
To be honest, I'm not even 100% sure where I'm supposed to be looking. When you say look at the source code, does this mean looking through each of the .c files that came back in the strings/grep command I ran (which I pasted the results of in my first post)? Or something else? And if it does mean looking through those files, what should I be looking out for to make sure that it's just debugging info and nothing to worry about?
Or does it mean search inside the src directory generated by the build process, for all references to $srcdir, and seeing what they're used for? I'm hoping this is not the case, as there are almost 5,000 instances of this happening!
+[ds9]$ cd /tmp/makepkg/ds9/
+[ds9]$ grep -rF /tmp/makepkg/ds9 src 2>&1 | wc -l
4948Last edited by fractal_sounds (2023-09-25 14:52:00)
Offline
Does not even build for me in a clean chroot without disabling buildflags
Ah I see. Hmmm. I just remember following the instructions on the Arch wiki for setting up my "/etc/makepkg.conf" file the first time I needed to build and install a package from AUR, so I'm guessing I probably don't have buildflags enabled by default.
Is that a bad sign (that it won't build for you without disabling buildflags)? Like does it mean it's not a well-put-together package build?
Apologies for the newbie questions. This is all still a bit of a new experience for me.
Offline
a821 wrote:Most of the time is used for debug info as said, but you need to look at the source code to be certain.
Thank you for the response. Would you by any chance be able to point me towards some resources for learning more about this? While I do have coding/scripting knowledge, I don't have enough experience with large-scale building/compiling to know what it is I actually need to be looking for here.
To be honest, I'm not even 100% sure where I'm supposed to be looking. When you say look at the source code, does this mean looking through each of the .c files that came back in the strings/grep command I ran (which I pasted the results of in my first post)? Or something else? And if it does mean looking through those files, what should I be looking out for to make sure that it's just debugging info and nothing to worry about?
Yes, I meant look at the whole source code. Looking at the build function, it calls a 'configure' script which in turn calls `pwd` in several places, so I would start following from there (perhaps it stores the path in a env variable that is passed to the C code, though it may be a red herring, who knows, I didn't look too deep). Maybe ask upstream?
Offline
Is that a bad sign (that it won't build for you without disabling buildflags)? Like does it mean it's not a well-put-together package build?
It would indicate the PKGBUILD has not been tested using a clean choot at least recently. There are currently differences between the default buildflags in /etc/makepkg.conf and the ones used to build in a clean chroot in /usr/share/devtools/makepkg.conf.d/x86_64.conf.
autoconf, automake, gcc and make being in makedepends when they are in dependencies of the base-devel package is unnecessary but not in any way harmful.
The only issue with the package containing references to $srcdir is as you already quoted it makes the package unreproducible, which is not an issue if you only want to build and use the package.
Offline
Yes, I meant look at the whole source code. Looking at the build function, it calls a 'configure' script which in turn calls `pwd` in several places, so I would start following from there (perhaps it stores the path in a env variable that is passed to the C code, though it may be a red herring, who knows, I didn't look too deep). Maybe ask upstream?
Thank you very much. Yep I see that now (about the instances of `pwd`).
When I have a bit more free time, I'll endeavour to look into this more deeply (it sounds like a good way to also become more familiar with how various pieces of source code fit together in a package build) and also try and get in touch with upstream.
Last edited by fractal_sounds (2023-09-26 14:31:37)
Offline
It would indicate the PKGBUILD has not been tested using a clean choot at least recently. There are currently differences between the default buildflags in /etc/makepkg.conf and the ones used to build in a clean chroot in /usr/share/devtools/makepkg.conf.d/x86_64.conf.
autoconf, automake, gcc and make being in makedepends when they are in dependencies of the base-devel package is unnecessary but not in any way harmful.The only issue with the package containing references to $srcdir is as you already quoted it makes the package unreproducible, which is not an issue if you only want to build and use the package.
Thank you very much for the response. Yep, I will only be building and using the package locally; and I've previously used it on other systems (macOS and Manjaro), and it's a widely used piece of software in the astrophysics industry, so I am fairly confident the $srcdir references are not intended to be malicious in any way. Of course I know you can't ever know for certain, but all things considered, it seems unlikely it would be anything non-benign.
I'm going to mark this as solved, and when I have some more time I'll perhaps try and get in touch with upstream to learn some more about why they designed it this way.
Thank you to everyone for your assistance.
Last edited by fractal_sounds (2023-09-27 20:48:48)
Offline