Should/can the install script included in source=() list?

Question

Hi,
It is a good thing that the sources needed to build a package are md5summed for integrity, but in most packages the install script is not. I was thinking why this might be - the PKGBUILD can be expected to modify the script?
  So to try, in one of my packages I added the install script to the source=() list. The package builds of course just fine. Then, however, if I want to upload it to AUR, I try to make a source-only package with "makepkg --source", which brakes with something like this:
ln: creating symbolic link `/tmp/foo/srclinks.YjYgQ8XlE/foo/foo.install': File exists
This is because makepkg tries to create a 2 symbolic links with the same filename: one link for the "foo.install" in the source=() list and also for the install=() list....
Is this deliberate, or a bug? Looks more like a bug to me, but thought I better ask first....
Cheers,
Greg

Answer 1

shining wrote:
imrehg wrote:
It might be completely internal to the pacman but defines actions taken on the system - thus whatever is in .install has effects just like the rest of the files, maybe even more: the other files are just copied, the .install is executed.
And while it might never get installed on the system, it's internals are - how else one could define a "post_uninstall()" if it wasn't stored? Being pacman developer you know much more about this than I do, can you give a bit of info on that?
Right it is installed to pacman database, but again, it is pacman doing all that.
Fair enough.... The detail, however, that is not installed does not preempt checksumming. Eg. patches are also: 1) used for the package, 2) not installed, and 3) still in the checksum....
shining wrote:
All I'm trying to get to, is there any serious reason (technical, not philosophical) NOT to checksum the install script as well?  Because I'm yet to see any valid arguments against it, and there are loads for it....
Taking your example from kernel26 :
-i $startdir/kernel26.install
-i ${pkgdir}/etc/mkinitcpio.d/${pkgname}.preset
Note that the scriptlet edited is the original one in $startdir , because that's the only place where it needs to be, from the packager pov.
While for the preset file, it needs to be copied to $pkgdir and it is edited there.
If you had a checksum for the scriptlet, it would also mean that makepkg -g output could be altered after running makepkg. Very weird..
Ok, this is indeed the case. But if you look at real packages, it seems that after the package is compiled, many times they update the PKGBUILD with the new md5sum values. Again: core/kernel26.
That .install update section in the PKGBUILD is then relegated to a "helper function" role that keep the information in sync when there's a new release, but as the PKGBUILD is distributed, it won't change anything in the .install anymore...
Thus, again, there's no real difference between the .install files and other files used as source.
shining wrote:Btw the whole scriptlet file could be created entirely from the pkgbuild build function.
Sure, and that's a great thing! I actually wondered why so many packages have separate .install when it can be done in the PKGBUILD. Thought it might be some convention, but probably just habit.... I prefer doing it in the PKGBUILD as well, whenever possible...
shining wrote:There might be ways to fix that, though I don't even see any good ones. But why bother ? You said there are loads of valid arguments to have it , but you didn't even give one !
On the other hand, I'm yet to find any of your rebuttals that are not rebutted here again...
shining wrote:What are you worried about here ? Security ? If you think adding a checksum for the install file is going to give you any security, you are badly fooling yourself. If someone is distributing a malicious pkgbuild, it can contain the md5sum of the malicious scriptlet which is shipped with it.
I think you misunderstood me. I'm not complaining, but inquiring. The PKGBUILD system is awesome, and it makes me search out programs that I use but not in the repo/AUR so that I can make a new package. But also, I'm interested in the "how" and "why", and hope to improve things if possible. Now, to me it seems theres an unreasonable distinction to checksum some files needed for a package but not all of them. And thus I set out to ask the elders here on the Forum to see whether someone can shed light on the reasons of the current state. Not trying to piss of anybody, but being interested.
Of course the md5sum is not security, it's a help, nothing more.
As an example: some time ago, there was a package in the community (thus managed by TUs) that had an update. I wanted to check out something in the package, got the PKGBUILD and tried to make it myself - md5sum says that the sources are incorrect.... Obviously something must have gone very bad, because the md5sum field was updated according to the SVN, the package is available on pacman thus it had to build, and the sources used in the package have not been changed for a while so that cannot be a problem....
I've got a package from a trusted source and it is broken, the md5sum told me. So the breakage can be the very same way in the install script, why is the md5sum not allowed to tell me that?
shining wrote:The only security for pkgbuilds is yourself. When you get one from a strange place, you MUST read the pkgbuild/install files.
Of course, never argued against it. But there are different layers of verbosity....
Anyway....