search

travis-ci / apt-package-safelist

Safelist of apt packages approved for build environments with restricted sudo
MIT License
109 stars 82 forks source link

APT whitelist request for qtbase5-dev #365

Open BanzaiMan opened 9 years ago

BanzaiMan commented 9 years ago

This replaces travis-ci/travis-ci#3765.

The original text by @equalsraf follows

Cheers

For Qt5 development, the ubuntu-sdk-team ppa was whitelisted in #3685, but the Qt packages still need to be whitelisted. There is a bunch of them, hopefully these are enough to get most people using Qt5 with Travis containers

qtbase5-dev, qtbase5-dev-tools, qtsensors5-dev, qtconnectivity5-dev, qt5-qmake, qt5-default, qtdeclarative5-dev, qtmultimedia5-dev, qtscript5-dev, qtxmlpatterns5-dev-tools, qtdeclarative5-dev-tools, qt5-image-formats-plugins

BanzaiMan commented 9 years ago

Ran tests and found setuid bits by purely textual search. Further analysis is required.

If these are found to be benign, add:

libqt5core5a libqt5gui5 libqt5libqgtk2 libqt5network5 libqt5opengl5 libqt5sql5 libqt5sql5-mysql libqt5sql5-odbc libqt5sql5-psql libqt5sql5-sqlite libqt5sql5-tds libqt5xml5 libqt5dbus5 libqt5test5 libqt5concurrent5 libqt5widgets5 libqt5printsupport5 qtbase5-dev qtbase5-private-dev libqt5opengl5-dev qtbase5-dev-tools qt5-qmake qtbase5-examples qtbase5-dbg qtbase5-dev-tools-dbg qtbase5-examples-dbg qt5-default qtbase5-doc-html

See https://travis-ci.org/travis-ci/apt-whitelist-checker/builds/72545323.

LionsPhil commented 9 years ago

From the whitelist-check build log, it looks like the positives are coming from QCoreApplication::setSetuidAllowed() and its documentation, and code around this, which cause Qt applications to error out if they detect they're running setuid unless it has been enabled. There doesn't appear to be an actual call to set the UID anywhere, only to read it, and to talk about setuid.

erbridge commented 9 years ago

Also qtbase5-private-dev.

mcallegari commented 8 years ago

Please add also qtscript5-dev and libqt5script For some reason qtscript5-doc has been whitelisted but not the above

My project also needs qtmultimedia5-dev and libqt5multimedia

Thanks

Spark-NF commented 8 years ago

I concur. Is there any specific reason almost all Qt5 packages are included but qtscript5-dev and qtmultimedia5-dev are not?

annejan commented 8 years ago

@Spark-NF qtscript5 is deprecated and will be removed in 5.7 (iirc)

jcelerier commented 8 years ago

@annejan looks like it's still in Qt 5.7 : https://wiki.qt.io/New_Features_in_Qt_5.7

annejan commented 8 years ago

I stand corrected, still deprecated, so not stable for long-term solutions . .

dexterlb commented 8 years ago

The Qt packages appear to have been removed from the ubunu-sdk-team ppa. Is there a way to obtain them now?

annejan commented 8 years ago

I'm currently using ppa:beineri/opt-qt561

Reverted my .travis.ym to the "old school" way of sudo: true

travisbot commented 6 years ago

This is an automated comment.

Ran tests, but could not found source package. Either the source package for qtbase5-dev does not exist, or the package needs an APT source. If you wish to add an APT source, please follow the directions on https://github.com/travis-ci/apt-source-whitelist#source-approval-process. Build results: https://travis-ci.org/travis-ci/apt-whitelist-checker/builds/440489764.