QEDK / configparser-rs

A simple configuration parsing utility with no dependencies built on Rust.
https://crates.io/crates/configparser
Other
66 stars 21 forks source link

2.0.0 crate contains files with a UNIX timestamp of 0, and some files are marked executable #15

Open dkg opened 3 years ago

dkg commented 3 years ago

The files in the configparser 2.0.0 crate tarball appear to have a UNIX timestamp of 0:

$ wget -q -O- https://crates.io/api/v1/crates/configparser/2.0.0/download | TZ=UTC tar xvvvz
-rw-r--r-- 0/0              74 1970-01-01 00:00 configparser-2.0.0/.cargo_vcs_info.json
-rwxr-xr-x 0/0              62 1970-01-01 00:00 configparser-2.0.0/.gitignore
-rwxr-xr-x 0/0             262 1970-01-01 00:00 configparser-2.0.0/.travis.yml
-rwxr-xr-x 0/0            2768 1970-01-01 00:00 configparser-2.0.0/CHANGELOG.md
-rw-r--r-- 0/0            1312 1970-01-01 00:00 configparser-2.0.0/Cargo.toml
-rwxr-xr-x 0/0             889 1970-01-01 00:00 configparser-2.0.0/Cargo.toml.orig
-rw-r--r-- 0/0            7650 1970-01-01 00:00 configparser-2.0.0/LICENSE-LGPL
-rw-r--r-- 0/0            1060 1970-01-01 00:00 configparser-2.0.0/LICENSE-MIT
-rwxr-xr-x 0/0            9021 1970-01-01 00:00 configparser-2.0.0/README.md
-rwxr-xr-x 0/0           27086 1970-01-01 00:00 configparser-2.0.0/src/ini.rs
-rwxr-xr-x 0/0            6830 1970-01-01 00:00 configparser-2.0.0/src/lib.rs
-rw-r--r-- 0/0             264 1970-01-01 00:00 configparser-2.0.0/tests/test.ini
-rwxr-xr-x 0/0            7198 1970-01-01 00:00 configparser-2.0.0/tests/test.rs
$

I'm trying to package configparser for debian and this makes the packaging run into the lintian error package-contains-ancient-file. I can work around it in the debian packaging, but I think the better thing would be for the crate itself to set appropriate timestamps internally.

dkg commented 3 years ago

I also note that no executable flags should be set on any of these files, but they are all set on .gitignore, .travis.yml, CHANGELOG.md, Cargo.toml.orig, README.md, src/lib.rs, src/ini.rs, and tests/test.rs.

QEDK commented 3 years ago

The files in the configparser 2.0.0 crate tarball appear to have a UNIX timestamp of 0:

$ wget -q -O- https://crates.io/api/v1/crates/configparser/2.0.0/download | TZ=UTC tar xvvvz
-rw-r--r-- 0/0              74 1970-01-01 00:00 configparser-2.0.0/.cargo_vcs_info.json
-rwxr-xr-x 0/0              62 1970-01-01 00:00 configparser-2.0.0/.gitignore
-rwxr-xr-x 0/0             262 1970-01-01 00:00 configparser-2.0.0/.travis.yml
-rwxr-xr-x 0/0            2768 1970-01-01 00:00 configparser-2.0.0/CHANGELOG.md
-rw-r--r-- 0/0            1312 1970-01-01 00:00 configparser-2.0.0/Cargo.toml
-rwxr-xr-x 0/0             889 1970-01-01 00:00 configparser-2.0.0/Cargo.toml.orig
-rw-r--r-- 0/0            7650 1970-01-01 00:00 configparser-2.0.0/LICENSE-LGPL
-rw-r--r-- 0/0            1060 1970-01-01 00:00 configparser-2.0.0/LICENSE-MIT
-rwxr-xr-x 0/0            9021 1970-01-01 00:00 configparser-2.0.0/README.md
-rwxr-xr-x 0/0           27086 1970-01-01 00:00 configparser-2.0.0/src/ini.rs
-rwxr-xr-x 0/0            6830 1970-01-01 00:00 configparser-2.0.0/src/lib.rs
-rw-r--r-- 0/0             264 1970-01-01 00:00 configparser-2.0.0/tests/test.ini
-rwxr-xr-x 0/0            7198 1970-01-01 00:00 configparser-2.0.0/tests/test.rs
$

I'm trying to package configparser for debian and this makes the packaging run into the lintian error package-contains-ancient-file. I can work around it in the debian packaging, but I think the better thing would be for the crate itself to set appropriate timestamps internally.

I'm guessing this is something to do with Cargo itself? I'm not quite sure how to handle this (a first for me), feel free to suggest ways. As for the executable files, should be relatively easy to resolve. Depending on when, we can slate this for 2.0.1/2.1.0.

nc7s commented 1 year ago

dkg has those lines in our debian/rules file, i.e. make file:

UPSTREAM_FILES = .cargo_vcs_info.json .gitignore .travis.yml CHANGELOG.md Cargo.toml Cargo.toml.orig LICENSE-* README.md src/*.rs tests/test.*

touch -d @$(SOURCE_DATE_EPOCH) $(UPSTREAM_FILES)
chmod ugo-x $(UPSTREAM_FILES)

which makes me suspect the executable bits came from a FAT like filesystem, since their files are all +x when copied to e.g. ext4. Ancient modified dates might've also come from that.

@QEDK Can you manually change their attrs? touch -c could make them modified "just now", chmod ugo-x to move their executable bits. Then add them and commit.