DescriptionMichael Catanzaro
2021-06-17 15:38:09 UTC
Hi, glib2 build is now failing in rawhide with:
+ /usr/lib/rpm/check-rpaths
*******************************************************************************
*
* WARNING: 'check-rpaths' detected a broken RPATH OR RUNPATH and will cause
* 'rpmbuild' to fail. To ignore these errors, you can set the
* '$QA_RPATHS' environment variable which is a bitmask allowing the
* values below. The current value of QA_RPATHS is 0x0000.
*
* 0x0001 ... standard RPATHs (e.g. /usr/lib); such RPATHs are a minor
* issue but are introducing redundant searchpaths without
* providing a benefit. They can also cause errors in multilib
* environments.
* 0x0002 ... invalid RPATHs; these are RPATHs which are neither absolute
* nor relative filenames and can therefore be a SECURITY risk
* 0x0004 ... insecure RPATHs; these are relative RPATHs which are a
* SECURITY risk
* 0x0008 ... the special '$ORIGIN' RPATHs are appearing after other
* RPATHs; this is just a minor issue but usually unwanted
* 0x0010 ... the RPATH is empty; there is no reason for such RPATHs
* and they cause unneeded work while loading libraries
* 0x0020 ... an RPATH references '..' of an absolute path; this will break
* the functionality when the path before '..' is a symlink
*
*
* Examples:
* - to ignore standard and empty RPATHs, execute 'rpmbuild' like
* $ QA_RPATHS=$(( 0x0001|0x0010 )) rpmbuild my-package.src.rpm
* - to check existing files, set $RPM_BUILD_ROOT and execute check-rpaths like
* $ RPM_BUILD_ROOT=<top-dir> /usr/lib/rpm/check-rpaths
*
*******************************************************************************
ERROR 0002: file '/usr/libexec/installed-tests/glib/gdbus-peer' contains an invalid runpath '/usr/libexec/installed-tests/glib' in [/usr/libexec/installed-tests/glib]
which is coming from https://fedoraproject.org/wiki/Changes/Broken_RPATH_will_fail_rpmbuild.
Problem is the runpath here looks fine. It is an absolute filename, so I don't see why it should fail the 0x0002 check. And it's pointing to a location for private libraries, which is also supposed to be allowed. The installed tests will not work without it.
I'm going to use __brp_check_rpaths %{nil} to disable check-rpath for the entire package as a temporary workaround.
I hit the same problem with swift-antlr4-runtime (a subpackage of antlr4-project), which has an RPATH pointing to the Swift runtime libraries, which are under /usr/libexec. The Swift support will not work unless it can find the Swift runtime, so in this case, too, the RPATH is valid.