Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-12 Thread Jim Pryor
On Tue, Jan 12, 2010 at 02:29:35PM +0100, Xyne wrote: > That doesnt work for overridden variables in split packages because they > are set inside the packaging function(s). Yes, right, good point. That answers a question I asked in another message. > Even without that to consider, you cannot bli

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-12 Thread Xyne
> If you're willing to trust the variable declaration part of the > PKGBUILD, then yeah it'd be easy to execute just that part. You don't > even need to cut out the build() function, since executing the whole > thing would only declare and not run that function. All you'd need to do > is to add som

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-12 Thread Xyne
> Indeed. Perhaps Allan would be interested on this for his makepkg test > suite, although maybe more in the concept since the test suite us in > python. It would be trivial to conver this to Python. I will probably do that myself if there seems to be enough interest in it.

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-12 Thread Xyne
> I was brainstorming to think of possible exploits. It looks like this is > valid syntax: > > echo normal stuff > exit 0 > any funky stuff I want > pkgver=#$#%$%%^&^...@#$$@^ } more funky stuff { > > Running bash -n on that gives 0. Now there's not necessarily anything > wrong here---unless your

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-11 Thread Jim Pryor
On Sat, Jan 09, 2010 at 09:23:56PM +0100, Xyne wrote: > I first check the PKGBUILD with "/bin/bash -n PKGBUILD". If this > command exits without error then the PKGBUILD contains valid syntax, > most importantly it does not contain extra closing brackets ("}"). > > This lets me wrap the entire PKG

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-11 Thread Jim Pryor
On Tue, Jan 12, 2010 at 07:52:54AM +0800, Sebastian Nowicki wrote: > >Bash simply parses the file and stores the code itself in the > >"pkgbuild" function, which itself contains other variables and > >functions (e.g. package_foo, build). Because the code has not been > >executed, the variables hav

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-11 Thread Sebastian Nowicki
On 10/01/2010, at 4:23, Xyne wrote: It is quite a clever idea. I haven't seen this approach before. I haven't looked at it thoroughly, but it looks like you're simply sourcing the PKGBUILD with some trickery not to execute the code. Why then the need for further parsing? Does `set` produce "r

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-09 Thread Xyne
Loui Chang wrote: > Wow this is quite clever. It definitely would make the job of parsing > much easier. Thanks for the explanation. :) I intend to flesh out the parser as special cases pop up. As already mentioned, there will be limits to what it can do depending on whether the packager uses co

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-09 Thread Loui Chang
On Sat 09 Jan 2010 21:23 +0100, Xyne wrote: > You haven't fully understood how it works so I hope you don't mind if I > try to explain it again. > > I first check the PKGBUILD with "/bin/bash -n PKGBUILD". If this > command exits without error then the PKGBUILD contains valid syntax, > most import

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-09 Thread Xyne
> It is quite a clever idea. I haven't seen this approach before. I > haven't looked at it thoroughly, but it looks like you're simply > sourcing the PKGBUILD with some trickery not to execute the code. Why > then the need for further parsing? Does `set` produce "raw" bash, e.g. > 'source=(

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-09 Thread Sebastian Nowicki
On 09/01/2010, at 2:50 AM, Xyne wrote: What was the problem with that from Sebastian which was discussed earlier on the mailing lists, IRCs ? How does it know more ? I don't know. I wrote this because I needed a PKGBUILD parser in Perl for Bauerbill. Maybe it's better, maybe it's worse. I po

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-08 Thread Xyne
> What was the problem with that from Sebastian which was discussed > earlier on the mailing lists, IRCs ? How does it know more ? > I don't know. I wrote this because I needed a PKGBUILD parser in Perl for Bauerbill. Maybe it's better, maybe it's worse. I posted it here in case someone finds it

Re: [aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-08 Thread Laszlo Papp
On Fri, Jan 8, 2010 at 6:06 PM, Xyne wrote: > Hi, > > There was no response on the pacman-dev list but someone here might > find this potentially useful: > > http://mailman.archlinux.org/pipermail/pacman-dev/2010-January/010322.html > > It's written in Perl but it could easily be adapted to Python

[aur-dev] Safe and relatively reliable PKGBUILD parser.

2010-01-08 Thread Xyne
Hi, There was no response on the pacman-dev list but someone here might find this potentially useful: http://mailman.archlinux.org/pipermail/pacman-dev/2010-January/010322.html It's written in Perl but it could easily be adapted to Python. It handles Bash variable interpolation and string substi