ubuntu-appstore-developers team mailing list archive

[Jamie Strandboge <jamie@xxxxxxxxxxxxx>]

On 12/18/2013 09:43 AM, Daniel Holbach wrote:
> Hey,
> 
> On 21.11.2013 23:52, Ted Gould wrote:
>> There was a discussion a while back on IRC about executing binaries in
>> fat packages.  After that I started a branch, but I just found it again,
>> and cleaned it up.  But I felt like we should probably make sure this is
>> what we want before I go ahead and commit it.  First here's the branch:
>>
>>     https://code.launchpad.net/~ted/upstart-app-launch/tracking-arch/+merge/196194
> 
> It looks like the branch is still up for review. Can somebody help
> getting this landed?
> 
> Thanks a bunch in advance.
> 

So, I made some changes to click-apparmor, sent it up for review and got the
following response:

"
- click package directory names appear to be constructed out of both the
  package name and the version, thus allowing for : in the directory. I
  know of no mechanism to prevent a : from being intepreted as anything
  other than a path separator in the LD_LIBRARY_PATH and QML2_IMPORT_PATH.
  We either should use a different mechanism to select library paths or
  ask the click packaging tool to filter out : characters. (That seems
  like a dangerous precedent though.)
"

This sounds somewhat dire, but actually two things are protecting us here:
 1. As it turns out, the AppStore does not allow for ':' in the version[1], but 
    it is allowed in the APP_ID on the system.
 2. Most importantly, 'click pkgdir' doesn't include the version in its result
    but instead uses a dir of the form:
    /opt/click.ubuntu.com/.click/users/<user>/<pkgname>

Click documentation[2] says that the click package name follows Debian source
package rules[3] (section 5.6.1), which says "Package names (both source and
binary, see Package, Section 5.6.7) must consist only of lower case letters
(a-z), digits (0-9), plus (+) and minus (-) signs, and periods (.). They must
be at least two characters long and must start with an alphanumeric character.

So, everything is good. :) However, I think it would be wise for
upstart-app-launch to filter ':' from the click pkgname to be defensive (with
an appropriate comment). I'll be doing the same in aa-exec-click.

Sending this to the list so that I can say that the decision to setup the
click pkgname in this way with click pkgdir was brilliant and very
thoughtful. Nice job! :)

[1]https://wiki.ubuntu.com/AppStore/Interfaces/ApplicationId
[2]http://bazaar.launchpad.net/~click-hackers/click/trunk/view/head:/doc/file-format.rst
[3]http://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Source

-- 
Jamie Strandboge                 http://www.ubuntu.com/

Attachment: signature.asc
Description: OpenPGP digital signature