Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#64114 - [yubioath-desktop] Multiple packaging mistakes/regressions after transfer from AUR

Attached to Project: Community Packages
Opened by Jensen McKenzie (your_doomsday) - Saturday, 12 October 2019, 19:20 GMT
Last edited by Filipe Laíns (FFY00) - Sunday, 13 October 2019, 16:09 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To Levente Polyak (anthraxx)
Filipe Laíns (FFY00)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Description:

yubioath-desktop was recently moved from AUR to community. Unfortunately new maintainer instead of copying old PKGBUILD which was battle-tested for a long time decided to write new one from scratch and things went south since then.

The first issue and most important one is broken runtime dependencies. It seems like someone was looking after "Dependency included and not needed" warning from namcap without the knowledge how this app work.

This was partially fixed by[1] but still "yubikey-manager" dep is missing without which this app can't work (I assume maintainer had it installed independently).

It's worth noting that AUR dependencies were based on upstream official packages for debian[2] but perhaps our maintainer was smarter than them.

Another obvious error is that it install app icon under license dir[3]:
"install -Dm 644 images/yubioath@2x.png "$pkgdir"/usr/share/licenses/$pkgname/yubioauth.png"

Using "BSD2" instead of "BSD" licence prints following error from namcap:
"yubioath-desktop E: BSD2 is not a common license (it's not in /usr/share/licenses/common/)"
which is fixed by switching back to "BSD" as old AUR package did.
Moreover for some weird reason license array has also "custom" in addition to "BSD2" one but upstream states in license file this package is copying that all files are under BSD(2) license[4]

Also in comparison with AUR version checking gpg signatures was stripped from PKGBUILD (also source was moved from modern git to old school tarballs).

There are also missing double quotes from some variables.

I'm attaching example PKGBUILD based on old AUR version with some modifications to match current syntax. Please consider adopting it instead of following NIH syndrome with above effects.

Additional info:
yubioath-desktop 5.0.0-2

[1] https://git.archlinux.org/svntogit/community.git/commit/trunk?h=packages/yubioath-desktop&id=e1d48e5e97b2b1b6efd3401065b4ec905816f190
[2] https://github.com/Yubico/yubioath-desktop/blob/master/debian/control#L8
[3] https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/yubioath-desktop&id=e1d48e5e97b2b1b6efd3401065b4ec905816f190#n34
[4] https://github.com/Yubico/yubioath-desktop/blob/master/debian/copyright#L5
This task depends upon

Closed by  Filipe Laíns (FFY00)
Sunday, 13 October 2019, 16:09 GMT
Reason for closing:  Fixed
Additional comments about closing:  yubioath-desktop 5.0.0-4
Comment by Jensen McKenzie (your_doomsday) - Saturday, 12 October 2019, 19:22 GMT
Promised attachement
   PKGBUILD (1.2 KiB)
Comment by Eli Schwartz (eschwartz) - Sunday, 13 October 2019, 01:10 GMT
Removing gpg signatures is a pretty bad security issue. Note that git should not be required (but it shall be used if it is the only way to get signed sources), because https://github.com/Yubico/yubioath-desktop/releases shows that each official release contains assets for the source tarball itself (not relying on github's /archive/$tag.tar.gz path) and .sig files to correspond.
Comment by Filipe Laíns (FFY00) - Sunday, 13 October 2019, 08:10 GMT
I made a typo when searching for the package on AUR and I just found the package later, that's why I rewrote it from scratch. The points made here I valid but I don't understand the aggressivity.

> It seems like someone was looking after "Dependency included and not needed" warning from namcap without the knowledge how this app work.

What does this mean?

> Another obvious error is that it install app icon under license dir[3]:
"install -Dm 644 images/yubioath@2x.png "$pkgdir"/usr/share/licenses/$pkgname/yubioauth.png"

Yes this was a typo, my bad.

> Also in comparison with AUR version checking gpg signatures was stripped from PKGBUILD (also source was moved from modern git to old school tarballs).

I did not notice that the releases seem to always have signed commits.

> There are also missing double quotes from some variables.

What issues? The only variables that need quotes are the compilation flags, pkgsrc and pkgdir. No other variable should contain spaces. This is perfectly fine.

> Please consider adopting it instead of following NIH syndrome with above effects.

Next time you contribute to arch please consider doing it in a more constructive way. If you want to be technical, be my guest, but don't make this sort of comments.

I will release a new package soon. Hope it will be of your liking.
Comment by Eli Schwartz (eschwartz) - Sunday, 13 October 2019, 14:37 GMT
Not actually fixed, reopening.
Comment by Jensen McKenzie (your_doomsday) - Sunday, 13 October 2019, 14:41 GMT
I'm copying below my report from https://bugs.archlinux.org/task/64118 to make it clear what's missing:


Description:

The line installing icon is as below[1]:

install -Dm 644 images/yubioath@2x.png "$pkgdir"/usr/share/pixmaps/$pkgname/yubioauth.png

There are two separate mistakes here and both of them break icon detection by system:

1. Icons in /usr/share/pixmaps shouldn't be installed in per-app subfolder (just look at what this folder contains):

Wrong: "$pkgdir"/usr/share/pixmaps/$pkgname/yubioauth.png

Correct "$pkgdir"/usr/share/pixmaps/yubioauth.png (but see below)

2. Icon name is changed during copy to a wrong one. The correct icon name should be after app name (modified case to make it more clear): yubioATH not yubioAUTH.

Wrong yubioauth.png

Correct yubioath.png

Fixing this two issues make icon detectable again.

Just yesterday I attached PKGBUILD which did all of this right[2] based on AUR version which did it right too. Unfortunately, that part wasn't included in Arch package.

Additional info:
yubioath-desktop 5.0.0-3

Steps to reproduce:
[1] https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/yubioath-desktop&id=dd0f703c6446ca4abfc9ccb938b59b80fb1721c8#n37
[2] https://bugs.archlinux.org/task/64114?getfile=17918
Comment by Eli Schwartz (eschwartz) - Sunday, 13 October 2019, 15:22 GMT
Anyway I'd suggest using the icons from https://github.com/Yubico/yubioath-desktop/tree/master/resources/icons which includes a 128x128 icon and a rescalable svg.

This is IMHO a lot more preferable than an 80x80 icon, plus it doesn't need to be renamed to remove "@2x" from the name. 80x80 icons don't really fit into *any* theme size... 128x128 does.
Comment by Jensen McKenzie (your_doomsday) - Sunday, 13 October 2019, 16:01 GMT
@eschwartz you're right

AUR package used "resources/icons/yubioath.png". The "images/yubioath@2x.png" was new maintainer invention which I kept in my PKGBUILD example to make it more acceptable for copy-paste which didn't succeeded anyway :)

Loading...