Mailing List Archive

On shebangs of scripts
Hi all,

Recently, we added a new QA check in Gentoo Prefix' Portage to check
shebangs (the #! things) of scripts before they are installed. We
basically did this simply because we don't want to use say
/usr/bin/perl and because this executable might not exist (e.g. on
vanilla FreeBSD). Even if it does exist, we still don't want to use it,
since we installed a newer/better version, that also can find the
installed packages. This basically does not affect Gentoo Linux,
however, we do run into several other cases right now that do affect
Gentoo Linux:

- shebangs like #!python, these are invalid and used by some python
packages
- shebangs like #!/usr/local/bin/python, this is not a good idea, used
IIRC by python itself
- shebangs like #!/bin/csh or #!/bin/tcsh that are correct in itself,
but basically need tcsh to be installed to run, e.g. vim does this

The problem with these is that they are executable scripts, e.g. a user
could expect them to be able to run, IMO. Solving this can be done by
fixing the shebang (as for the first two cases), adding a runtime
dependency (for the last case), or by removing the executable bit of the
scripts so they no longer can be run, and they merely become
examples/documentation.

Should we start filing bugs on these issues? In the end, they are
broken scripts on the system. Is there interest for porting the Prefix
shebang QA check to normal Portage?


--
Fabian Groffen
Gentoo on a different level
Re: On shebangs of scripts [ In reply to ]
Fabian Groffen wrote:
> Should we start filing bugs on these issues? In the end, they are
> broken scripts on the system. Is there interest for porting the Prefix
> shebang QA check to normal Portage?

Sounds useful to me, my vote for it.



Sebastian
Re: On shebangs of scripts [ In reply to ]
On Wed, Sep 23, 2009 at 2:53 AM, Fabian Groffen <grobian@gentoo.org> wrote:
> Hi all,
>
> Recently, we added a new QA check in Gentoo Prefix' Portage to check
> shebangs (the #! things) of scripts before they are installed.  We
> basically did this simply because we don't want to use say
> /usr/bin/perl and because this executable might not exist (e.g. on
> vanilla FreeBSD).  Even if it does exist, we still don't want to use it,
> since we installed a newer/better version, that also can find the
> installed packages.  This basically does not affect Gentoo Linux,
> however, we do run into several other cases right now that do affect
> Gentoo Linux:
>
> - shebangs like #!python, these are invalid and used by some python
>  packages
> - shebangs like #!/usr/local/bin/python, this is not a good idea, used
>  IIRC by python itself
> - shebangs like #!/bin/csh or #!/bin/tcsh that are correct in itself,
>  but basically need tcsh to be installed to run, e.g. vim does this
>
> The problem with these is that they are executable scripts, e.g. a user
> could expect them to be able to run, IMO.  Solving this can be done by
> fixing the shebang (as for the first two cases), adding a runtime
> dependency (for the last case), or by removing the executable bit of the
> scripts so they no longer can be run, and they merely become
> examples/documentation.

Should there ever be executable scripts in /usr/share? If the
consensus is 'no', could portage remove the +x bit automatically?

Other distros debate about +x in /usr/share/doc too:
https://bugzilla.redhat.com/show_bug.cgi?id=487527#c3 - From what I
gather, other distros decided that they can be +x if they work
properly (meaning, proper dependencies)

>
> Should we start filing bugs on these issues?  In the end, they are
> broken scripts on the system.  Is there interest for porting the Prefix
> shebang QA check to normal Portage?
>
>
> --
> Fabian Groffen
> Gentoo on a different level
>
>
Re: On shebangs of scripts [ In reply to ]
On Wednesday 23 September 2009 10:09:23 Jeremy Olexa wrote:
> On Wed, Sep 23, 2009 at 2:53 AM, Fabian Groffen <grobian@gentoo.org> wrote:
> > The problem with these is that they are executable scripts, e.g. a user
> > could expect them to be able to run, IMO. Solving this can be done by
> > fixing the shebang (as for the first two cases), adding a runtime
> > dependency (for the last case), or by removing the executable bit of the
> > scripts so they no longer can be run, and they merely become
> > examples/documentation.
>
> Should there ever be executable scripts in /usr/share? If the
> consensus is 'no', could portage remove the +x bit automatically?

i dont see anything wrong with +x in /usr/share in general. they're shell
scripts and thus platform independent, so /usr/share is the place for them to
live. packages may internally execute these things, so blindly stripping +x
bits sounds like a bit idea.
-mike
Re: On shebangs of scripts [ In reply to ]
On Wednesday 23 September 2009 03:53:43 Fabian Groffen wrote:
> Should we start filing bugs on these issues? In the end, they are
> broken scripts on the system. Is there interest for porting the Prefix
> shebang QA check to normal Portage?

for the shell dependency issue, a review bug may be useful, but keep in mind
nothing may change. if a package installs examples for a bunch of shells and
they're intended for end user use only, then it doesnt make sense to have that
package depend on every shell that it installs helpers for.

for the other issues, there should be bugs and you should get those checks
merged to portage proper.
-mike