On 12/18/2013 09:43 AM, Daniel Holbach wrote: > Hey, > > On 21.11.2013 23:52, Ted Gould wrote: >> There was a discussion a while back on IRC about executing binaries in >> fat packages. After that I started a branch, but I just found it again, >> and cleaned it up. But I felt like we should probably make sure this is >> what we want before I go ahead and commit it. First here's the branch: >> >> >> https://code.launchpad.net/~ted/upstart-app-launch/tracking-arch/+merge/196194 > > It looks like the branch is still up for review. Can somebody help > getting this landed? > > Thanks a bunch in advance. >
So, I made some changes to click-apparmor, sent it up for review and got the
following response:
"
- click package directory names appear to be constructed out of both the
package name and the version, thus allowing for : in the directory. I
know of no mechanism to prevent a : from being intepreted as anything
other than a path separator in the LD_LIBRARY_PATH and QML2_IMPORT_PATH.
We either should use a different mechanism to select library paths or
ask the click packaging tool to filter out : characters. (That seems
like a dangerous precedent though.)
"
This sounds somewhat dire, but actually two things are protecting us here:
1. As it turns out, the AppStore does not allow for ':' in the version[1], but
it is allowed in the APP_ID on the system.
2. Most importantly, 'click pkgdir' doesn't include the version in its result
but instead uses a dir of the form:
/opt/click.ubuntu.com/.click/users/<user>/<pkgname>
Click documentation[2] says that the click package name follows Debian source
package rules[3] (section 5.6.1), which says "Package names (both source and
binary, see Package, Section 5.6.7) must consist only of lower case letters
(a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must
be at least two characters long and must start with an alphanumeric character.
So, everything is good. :) However, I think it would be wise for
upstart-app-launch to filter ':' from the click pkgname to be defensive (with
an appropriate comment). I'll be doing the same in aa-exec-click.
Sending this to the list so that I can say that the decision to setup the
click pkgname in this way with click pkgdir was brilliant and very
thoughtful. Nice job! :)
[1]https://wiki.ubuntu.com/AppStore/Interfaces/ApplicationId
[2]http://bazaar.launchpad.net/~click-hackers/click/trunk/view/head:/doc/file-format.rst
[3]http://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Source
--
Jamie Strandboge http://www.ubuntu.com/
signature.asc
Description: OpenPGP digital signature
-- Mailing list: https://launchpad.net/~ubuntu-appstore-developers Post to : ubuntu-appstore-developers@lists.launchpad.net Unsubscribe : https://launchpad.net/~ubuntu-appstore-developers More help : https://help.launchpad.net/ListHelp
