Opened 20 months ago
Last modified 7 weeks ago
#67161 assigned defect
ipmitool @1.8.19: fetches a file at build time
Reported by: | ryandesign (Ryan Carsten Schmidt) | Owned by: | drkp (Dan Ports) |
---|---|---|---|
Priority: | Normal | Milestone: | |
Component: | ports | Version: | 2.8.1 |
Keywords: | Cc: | ||
Port: | ipmitool |
Description
The ipmitool build system downloads the URL http://www.iana.org/assignments/enterprise-numbers.txt and installs it as /opt/local/share/misc/enterprise-numbers. This means the port's build is not reproducible: somebody who installs the port today won't necessarily get the same software as if they install it next week, if the contents of that URL change by then. It also means the successful build of the port is at the mercy of a third-party web site, whose structure could change; see #67156 where this did happen.
The solution, as always, is for the portfile to specify all of the files it needs, along with their checksums, and for the build system to use the file MacPorts fetched rather than fetching its own copy. The port's revision should be increased, and the checksums updated, whenever the upstream URL changes. The URL is unversioned, which presents a set of surmountable challenges. A method such as the one employed by the curl-ca-bundle port could be used. I can make these changes to the ipmitool Portfile if you agree with the idea.
Change History (2)
comment:1 Changed 7 weeks ago by joshenders (Josh Enders)
comment:2 Changed 7 weeks ago by drkp (Dan Ports)
I didn't realize it was doing this (and somehow missed this ticket til now). If anyone wants to make the necessary changes to fix this, go ahead. Otherwise, I'll take care of it, but no promises on when I will be able to find time.
+1 thanks for opening this