#1090336 sbuild: leaks env variables when using $environment_filter

#1090336#5
Date:
2024-12-17 00:22:05 UTC
From:
To:
Hello josch.

After adding the following lines to my .sbuildrc file:

use Dpkg::Build::Info;
$environment_filter = [Dpkg::BuildInfo::get_build_env_allowed(), 'GNUMAKEFLAGS'];

the build logs now contain variables (used by the script I use to call
sbuild) which were never meant to be passed to the build environment.

Note: I discovered this by "accident":

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1090244


The lines I added to .sbuildrc are copied verbatim from the manpage:

# Appending FOOBAR to the default
use Dpkg::Build::Info;
$environment_filter = [Dpkg::BuildInfo::get_build_env_allowed(), 'FOOBAR'];

except that I'm using GNUMAKEFLAGS (to pass --shuffle) instead of FOOBAR.

So it seems that there is something wrong somewhere, but I don't know where.
It is completely possible that I misunderstood the given example.

One thing that I don't understand here is why the example should work at all,
given that get_build_env_allowed() returns a list of environment variables,
not a list of regular expressions. Is the example correct at all?

Thanks.

#1090336#8
Date:
2024-12-17 10:30:28 UTC
From:
To:
Hi Santiago,

Quoting Santiago Vila (2024-12-17 01:22:05)

you are right! You found a bug in the documentation, thank you!

The correct entry for your ~/.sbuildrc or ~/.config/sbuild/config.pl should be:

use Dpkg::Build::Info;
$environment_filter = [(sort (map "^$_\$", Dpkg::BuildInfo::get_build_env_allowed())), '^GNUMAKEFLAGS$'];

You can also write 'GNUMAKEFLAGS' instead of '^GNUMAKEFLAGS$' but the former
will also match any other environment variables containing the string
"GNUMAKEFLAGS", so putting a ^ and a $ at the stard and end, respectively makes
it a bit safer. This should fix it:

https://salsa.debian.org/debian/sbuild/-/merge_requests/117

Thanks!

cheers, josch

#1090336#13
Date:
2024-12-17 10:42:27 UTC
From:
To:
Should this (and the docs) then maybe say this instead (untested):

$environment_filter =  [@{$conf->_get_default('ENVIRONMENT_FILTER')}, '^GNUMAKEFLAGS$'];

?

Chris

#1090336#18
Date:
2024-12-17 11:16:45 UTC
From:
To:
El 17/12/24 a las 11:42, Chris Hofstaedtler escribió:

I think that would be more elegant (more "high level" language-wise).

We would take sbuild's own default (which in turn is taken from dpkg at run time)
and add or substract the user's variable. If you decide to adopt that change,
I would also change the next example in the manpage to match.

[ While we are at it, I would put "Examples" instead of "Example" at the beginning and maybe
add a blank line between one example and another. At some point I believed you had to
write all that together, because it was a single example ].

Thanks.

#1090336#21
Date:
2024-12-17 13:04:01 UTC
From:
To:
Hi,

Quoting Chris Hofstaedtler (2024-12-17 11:42:27)

as you can see, I'm not yet used to abusing the existence of $conf in the
eval() context of the "config" file. Did you manage to try out my patch in

https://salsa.debian.org/debian/sbuild/-/merge_requests/104#note_559973

Because if that works, then it could be done even simpler by doing:

push @{$environment_filter}, '^GNUMAKEFLAGS$';

Thanks!

cheers, josch

#1090336#26
Date:
2024-12-17 13:48:54 UTC
From:
To:
On Tue, Dec 17, 2024 at 02:04:01PM +0100, Johannes Schauer Marin Rodrigues wrote:
[..]

I'm in the process of doing that. Lets continue this part of the
discussion in #1090358.

Chris

#1090336#29
Date:
2024-12-17 16:03:03 UTC
From:
To:
Hi,

Quoting Santiago Vila (2024-12-17 12:16:45)

I agree.

Yes, I'd like to order this fix *after* whatever solution we apply to fix
#1090358. As somebody who uses sbuild in a very different setup compared to
probably most of its users, if you have time, you could try out the patch in
the initial message of that bug and see if anything breaks with it.  I'm quite
sure that something will break but I have not yet found something that does. :D

Maybe it should be "Example(s):" because the code does not know if one or many
examples follow.

You mean to separate what is currently separated by lines that consist of code
comments with empty lines as well?

Thanks!

cheers, josch

#1090336#32
Date:
2025-01-06 16:03:30 UTC
From:
To:
Hello,

Bug #1090336 in sbuild reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/sbuild/-/commit/b8dc24140998ccffd1453dea17a93c5de01abb66
------------------------------------------------------------------------
lib/Sbuild/Conf.pm: fix examples for ENVIRONMENT_FILTER

Reported-By: Santiago Vila <sanvila@debian.org>
Closes: #1090336
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1090336

#1090336#39
Date:
2025-01-16 07:05:14 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
sbuild, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1090336@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Johannes Schauer Marin Rodrigues <josch@debian.org> (supplier of updated sbuild package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 16 Jan 2025 07:46:28 +0100
Source: sbuild
Architecture: source
Version: 0.88.2
Distribution: unstable
Urgency: medium
Maintainer: sbuild maintainers <sbuild@packages.debian.org>
Changed-By: Johannes Schauer Marin Rodrigues <josch@debian.org>
Closes: 1089035 1089105 1090336 1090358 1091169 1091170 1091370 1092091 1092557
Changes:
 sbuild (0.88.2) unstable; urgency=medium
 .
   [ Johannes Schauer Marin Rodrigues ]
   * lib/Sbuild/Conf.pm:
      - fix examples for ENVIRONMENT_FILTER (Closes: #1090336)
      - do not ignore an empty DEB_BUILD_PROFILES environment variable
      - Add CHROOT_ALIASES configuration option, allowing one to look up chroots
        under a different name (Closes: #1089035)
   * lib/Sbuild/ConfBase.pm:
      - run check after setting all values
      - preserve order of configuration options
      - Set variables to their default values in ~/.config/sbuild/config.pl
        (Closes: #1090358)
   * lib/Sbuild/ChrootUnshare.pm:
      - check if mmdebstrap is installed only when needed
      - instead of passing the tarball path to the decompressor, let sbuild open
        it and feed it to the decompressor program via standard input (Closes:
        #1091169)
   * debian/tests/unshare:
      - install ca-certificates for https debci hosts. Thanks to Paul Gevers
      - run dpkg-deb with --root-owner-group (Closes: #1092091)
   * lib/Sbuild/Build.pm: fail if dpkg --print-foreign-architectures failed
   * lib/Sbuild/ResolverBase.pm: build metapackage with dpkg-deb
     --root-owner-group (Closes: #1092557)
   * Use dpkg-buildtree to figure out if fakeroot is required
   * die if exec fails because it cannot find the program
 .
   [ Simon McVittie ]
   * man: Cross-reference the --build-dir option in BUILD ARTIFACTS
   * man: Document how and where log files are saved
 .
   [ Guillem Jover ]
   * lib/Sbuild/Conf.pm: Do not use deprecated Dpkg::Build::Info module
 .
   [ Chris Hofstaedtler ]
   * Remove deborphan from Suggests:, package was removed
   * sbuild-update: abort if chroot-mode=unshare (Closes: #1089105, #1091370)
 .
   [ Santiago Ruano Rincón ]
   * Add Recommends on iproute2
   * Fix mmdebstrap+unshare setup-hook when handling *-security suites
 .
   [ Jakub Wilk ]
   * man: Remove stray quotation mark
 .
   [ Richard Lewis ]
   * man/sbuild.1.in: remove stray quotation mark
   * Document the need to retain package lists in the chroot if $apt_update is 0
     (Closes: #1091170)
 .
   [ Jochen Sprickerhof ]
   * unshare: Use $BUILD_USER as the default user
   * unshare: Use 'sbuild' as the default user
   * Use BUILD_USER for architecture and disk space check
Checksums-Sha1:
 0f0099edcbf367fae51ea461298ed81e97f28812 2643 sbuild_0.88.2.dsc
 7c8afb029abcb8524160a037aee55cf1ff601080 255988 sbuild_0.88.2.tar.xz
Checksums-Sha256:
 43147313e02531d784b5fed0b81ad45481bc89e0b17f13c89cdc268d91a3af47 2643 sbuild_0.88.2.dsc
 569736857d4e906faf50ce25baa3e10d45d4be983237b70ce4e1e00871557116 255988 sbuild_0.88.2.tar.xz
Files:
 47556984b7a862d35ab78354c7c3a68c 2643 devel optional sbuild_0.88.2.dsc
 1b63edbc9459af6f09986dfc82e34a74 255988 devel optional sbuild_0.88.2.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmeIq2YACgkQ8sulx4+9
g+ESFQ//Y/wgtNcLRqfw/sIWtUd1OC1a/o2U26BHY9KZjW5Rqp01B4FepDwoH3c/
r+brucA3j2/0nvx6BpcF2EupcMlgPpY4J4EYmisyZrHgYBPlHyc8LyKVm2gDEnPV
LapflaCbdTWprYQoijxdjQ9lGJiz1XQCS+xhwI8EcIK+KXxx18pbB3i3DSLhEkX/
Ud5qHb0Y/tnj+xtdKVZED+Z6AmlGiT0+GEjWw1N7bC+uLy2J8IbdUB37ANopvVtE
l3u54HIh8M/+hDW7B4X/QeB+houFPXzRNZx+QlccWJvf19MiPPKpbOa213ieG5IH
raijuMEwNzH2PevH8nBKA1REcIAyYXlcdk4OaLm3rsiXLk2rPtXaVbFazxMiqP8m
3UyOMPmBfZSjOMjkbVtYHiw6YuA7uYCejyW5h//jW1v4NNBVQZKbHAddLjp4m6+A
oBSbuGLVamTvqcUJG+n94V+U1pRHCtvvvtYHi4h991k4Cph/klzYF3zHmZsxcET6
WBaOv4erPMP1BJkD7B2O5oxGr8tJ/jprEKtbJa1LsNakjDu7pBYumL+mmj4OKlhO
oIjw3ujGfVkXE+9Glmtj5WRTZTzRJ+cYz6zTQfwJRZ3WJxLtmJCUazK+uXi/VL01
M3bNHlwwCAyLDZ9yGm45YwneY7EiMfZytL6S8czYs+FTwXRC8og=
=H3Yw
-----END PGP SIGNATURE-----