From owner-freebsd-ports@FreeBSD.ORG Thu Sep 25 20:51:04 2014 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E42F0C7; Thu, 25 Sep 2014 20:51:04 +0000 (UTC) Received: from mail-ig0-x233.google.com (mail-ig0-x233.google.com [IPv6:2607:f8b0:4001:c05::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id A4E95DD0; Thu, 25 Sep 2014 20:51:04 +0000 (UTC) Received: by mail-ig0-f179.google.com with SMTP id l13so9143802iga.6 for ; Thu, 25 Sep 2014 13:51:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=3/ge5v5Y4wmMvNIAeOIhm2f2nJV1khxteGyGjfCqzik=; b=NdnunhUbAsk7BUMlfpe9loT6+vwueXUx7rVQ/thddqyxLwyNK2Qk2ZKgUS4GOtSbHm OzQTpo79noszQADexp1upugW6pqzPHSEQWzSHYNjwBbxPzFgWiirSkh7oTB1OzJ5Q6xO /hO/lztNBUhs5LaJZwRJREMInaXNfJ4NXSkd0BMJkhQNfkCPouYSCgEFUySeg+DGWnUN k+G6VML+x/rKikA6NRCHVbpqmAOXZHG8CclhkfwfOwtVXY954U/q/nRgaf3J/XP/Fpy6 Nb/rG9BUH8F8m2Pahts+Zdl1fcecyhxmdfjmms7V1VIRJiRwp4hy6dZAqRy4fUTkGBve w7Cg== MIME-Version: 1.0 X-Received: by 10.42.212.146 with SMTP id gs18mr5036331icb.96.1411678263995; Thu, 25 Sep 2014 13:51:03 -0700 (PDT) Sender: vrwmiller@gmail.com Received: by 10.64.165.73 with HTTP; Thu, 25 Sep 2014 13:51:03 -0700 (PDT) In-Reply-To: <54246761.8060405@madpilot.net> References: <54233850.2070807@FreeBSD.org> <54242A0E.6000507@madpilot.net> <54246761.8060405@madpilot.net> Date: Thu, 25 Sep 2014 16:51:03 -0400 X-Google-Sender-Auth: naCGICxhSiInrLgWiTzr96OfJAY Message-ID: Subject: Re: Poudriere Build of pkg_* repos? From: Rick Miller To: Guido Falsi Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: freebsd-ports , Bryan Drewery X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Sep 2014 20:51:05 -0000 On Thu, Sep 25, 2014 at 3:05 PM, Guido Falsi wrote: > On 09/25/14 20:57, Rick Miller wrote: > > On Thu, Sep 25, 2014 at 10:43 AM, Guido Falsi wrote: > > [snip] > > > > ======================= >============================ > > ===> Patching for bash-4.3.24 > > ===> Applying distribution patches for bash-4.3.24 > > ===> Applying extra patch /distfiles/local-patches/8_4-amd64/bash.patch > > ===> Applying extra patch > > /usr/ports/shells/bash/files/extrapatch-colonbreakswords > > ===> Applying extra patch > > /usr/ports/shells/bash/files/extrapatch-implicitcd > > ===> Applying FreeBSD patches for bash-4.3.24 > > > =========================================================================== > > > > The first sign that something didn't appear to have gone as expected was > > that the package was built as bash-4.3.24.tbz as opposed to > > bash-4.3.25.tbz. The above test was executed observing the behavior of a > > still vulnerable binary. > > The way you are applying the patch simply modifies the code being > compiled by the port, you're not patching the port itself, so the port > maintains the same version number. > Makes sense > > The test was performed on an 8.4 host with a [unpatched] bash-4.3.24 > after > > forcefully removing the package and adding the new, patched package. It > > complained of dependencies on packages that were already installed, but > not > > up to the version of the dependency. After manually fixing these > > dependencies (forcefully deleting the existing dependencies and > installing > > the new ones), the test was executed once again to the same results. > > > > Could this be an issue of the order the patches were applied in or ?? > > You should check the build log and see if in the patching phase there > was any error. > The above log snippet is from the patch phase of the build indicating success (well, at least no error). A build with the wrong patch was attempted that did indicate errors, as expected. The full log can be viewed at http://pastebin.com/hwHwJAKK Is there some way in the log to identify if the source was patched and built correctly? Does Poudriere [ I say Poudriere realizing that it likely does not, but perhaps the system does? ] provide the ability to review the source code after patching to actually verify the patch was applied? A cursory search of the filesystem where Poudriere stores the jail turned up no leads. -- Take care Rick Miller