Debian Bug report logs - #539315
[checks/scripts] Don't warn about executable .jars

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Matthew Johnson <mjj29@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: lintian: Lintian should not warn about executable jars

Date: Thu, 30 Jul 2009 17:34:17 +0100

Package: lintian
Severity: wishlist


debian-java policy is being updated to allow executable jar files as
long as they depend on jarwrapper, which implements a binfmt_misc
wrapper to run them. Currently lintian produces an
executable-not-elf-or-script warning about such files.

I am detecting jar files using the zip magic bytes (since they are zip
files) and the existence of a META-INF/MANIFEST.MF file inside.

Matt

-- System Information:
Debian Release: 5.0.1
  APT prefers stable
  APT policy: (500, 'stable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.18-4-686 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages lintian depends on:
ii  binutils            2.18.1~cvs20080103-7 The GNU assembler, linker and bina
ii  diffstat            1.45-2               produces graph of changes introduc
ii  dpkg-dev            1.14.25              Debian package development tools
ii  file                4.26-1               Determines file type using "magic"
ii  gettext             0.17-4               GNU Internationalization utilities
ii  intltool-debian     0.35.0+20060710.1    Help i18n of RFC822 compliant conf
ii  libparse-debianchan 1.1.1-2              parse Debian changelogs and output
ii  libtimedate-perl    1.1600-9             Time and date functions for Perl
ii  liburi-perl         1.35.dfsg.1-1        Manipulates and accesses URI strin
ii  man-db              2.5.2-4              on-line manual pager
ii  perl [libdigest-sha 5.10.0-10            Larry Wall's Practical Extraction 

lintian recommends no packages.

-- no debconf information

Message #12 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Vincent Cheng <vincentc1208@gmail.com>

To: 539315@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: lintian: Lintian should not warn about executable jars

Date: Sat, 12 May 2012 19:41:36 -0700

tag 539315 + patch
thanks

Here's a quick patch to exclude .jar files from triggering
executable-not-elf-or-script.

diff --git a/checks/scripts b/checks/scripts
index 47d5a4e..59d5dfb 100644
--- a/checks/scripts
+++ b/checks/scripts
@@ -468,6 +468,7 @@ foreach (keys %executable) {
                  or $scripts{$_}
                  or $_ =~ m,^usr(?:/X11R6)?/man/,
                  or $_ =~ m/\.exe$/ # mono convention
+                 or $_ =~ m/\.jar$/ # Debian Java policy 2.2
                  );
 }

Message #19 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Wookey <wookey01@arm.com>

To: 539315@bugs.debian.org

Subject: executable-not-elf-or-script test should know about jars

Date: Fri, 18 May 2012 14:41:20 +0100

The lintian test executable-not-elf-or-script comes up with false
positives for every properly-packaged java app in Debian because those
have executable .jar files (pointed to by a link in /usr/bin). This is
what javahelper makes for you automatically, so it's slightly galling
to be told by lintian that it's not right.

This affects two of my packages.

Can we teach this test that .jars are valid executables like elf files
and things with shebang lines?

Or is there some reason why that's a bad plan?

Alternatively we should teach javahelper to automatically put in a lintian override
to supress this.

Aha - I see there is already a (3 yr old!) bug about this, and someone has just
supplied a patch. Any reason not to upload this?

Wookey

Message #24 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Niels Thykier <niels@thykier.net>

To: Wookey <wookey01@arm.com>, 539315@bugs.debian.org, Matthew Johnson <mjj29@debian.org>, Vincent Cheng <vincentc1208@gmail.com>, binfmt-support@packages.debian.org

Subject: Re: Bug#539315: executable-not-elf-or-script test should know about jars

Date: Sat, 09 Jun 2012 12:08:38 +0200

clone 539315 -1
reassign -1 debian-policy
retitle -1  §10.5 Please clarify symlinks to jar files
thanks

Hi,

CC'ing all listed on the bugs and the binfmt-support maintainer.

On 2012-05-18 15:41, Wookey wrote:
> The lintian test executable-not-elf-or-script comes up with false
> positives for every properly-packaged java app in Debian because those
> have executable .jar files (pointed to by a link in /usr/bin). This is
> what javahelper makes for you automatically, so it's slightly galling
> to be told by lintian that it's not right.
> 
> This affects two of my packages.
> 
> Can we teach this test that .jars are valid executables like elf files
> and things with shebang lines?
> 
> Or is there some reason why that's a bad plan?
> 
> Alternatively we should teach javahelper to automatically put in a lintian override
> to supress this.
> 

While I agree the current situation is sub-optimal, I have concerns
about the use of jarwrapper and executable jars in general.  I believe I
have already voiced (some of) them to Matthew, but here goes.

My major concern is non-Linux architectures - jarwrapper relies on
binfmt-support.  Last I checked (a year or more ago) it wasn't available
on kfreebsd (nor hurd).
  While it appears to have built there now its description still gives
me feeling of it being "Linux-only".  Though, I hope Colin can clarify
binfmt-support's situation on non-Linux archs.



There are is also Policy §10.5:

"""
A symbolic link pointing to a compressed file should always have the
same file extension as the referenced file. (For example, if a file
foo.gz is referenced by a symbolic link, the filename of the link has to
end with ".gz" too, as in bar.gz.)
"""

Jar files are zip files, so it should most likely be considered a
compressed file.  I notice that (e.g.) sat4j "violates this" and uses
/usr/bin/sat4j to point to a jar file in /usr/share/java (with a .jar
extension).
  I know the Policy reads "should" here, but I have a feeling .jar could
become (or is?) a "noticeable exception" to this rule (and in that case
deserves mentioning in the Policy).
  Anyhow, I have cloned this bug and will defer that part to the Policy
team.

> Aha - I see there is already a (3 yr old!) bug about this, and someone has just
> supplied a patch. Any reason not to upload this?
> 
> Wookey
> 
> 
> 

It is definitely about time we did something about it.  Sorry for the
delay.  :)

~Niels

(Please CC me explicitly on the Policy part of this bug)

Message #31 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Matthew Johnson <mjj29@debian.org>

To: Niels Thykier <niels@thykier.net>

Cc: Wookey <wookey01@arm.com>, 539315@bugs.debian.org, Vincent Cheng <vincentc1208@gmail.com>, binfmt-support@packages.debian.org

Subject: Re: Bug#539315: executable-not-elf-or-script test should know about jars

Date: Sat, 9 Jun 2012 11:23:22 +0100

[Message part 1 (text/plain, inline)]

On Sat Jun 09 12:08, Niels Thykier wrote:
> There are is also Policy §10.5:
> 
> """
> A symbolic link pointing to a compressed file should always have the
> same file extension as the referenced file. (For example, if a file
> foo.gz is referenced by a symbolic link, the filename of the link has to
> end with ".gz" too, as in bar.gz.)
> """
> 
> Jar files are zip files, so it should most likely be considered a
> compressed file.  I notice that (e.g.) sat4j "violates this" and uses
> /usr/bin/sat4j to point to a jar file in /usr/share/java (with a .jar
> extension).

I don't want to disagree with Niels' point about binfmt-misc, but I do think
the fact that jar files are zip files here is coincidental. People are not
meant to interact with them as zip files, they are meant to load them as Java
libraries or programs. Using zip (and not elf, or something else) as the
packaging format is an implementation detail.

If executable jars via binfmt-misc is allowed then they certainly should be on
the path without a .jar extension - users should invoke them without any need 
to know they are written in Java.

Matt

[signature.asc (application/pgp-signature, inline)]

Message #36 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Niels Thykier <niels@thykier.net>

Cc: Wookey <wookey01@arm.com>, 539315@bugs.debian.org, Matthew Johnson <mjj29@debian.org>, Vincent Cheng <vincentc1208@gmail.com>, binfmt-support@packages.debian.org

Subject: Re: Bug#539315: executable-not-elf-or-script test should know about jars

Date: Sat, 9 Jun 2012 16:06:42 +0100

On Sat, Jun 09, 2012 at 03:58:26PM +0100, Colin Watson wrote:
> I tried to arrange that the general design should be amenable to a
> non-Linux implementation.  That said, it's true that nobody has so far
> got round to coming up with one.  I would expect it to be fairly trivial
> to write a Hurd implementation, seeing as binfmt_misc is really just a
> special case of translators; I don't know what it would take to
> implement it on kFreeBSD.

An alternative, incidentally, would be to use a small shim which looks
something like this (entirely untested):

  #! /bin/bash
  set -e

  NL="
  "

  case $(uname) in
      Linux)
          exec "$@"
          ;;
      *)
          shopt -s execfail
          OLD_IFS="$IFS"
          IFS="$NL"
          RET=0
          for interpreter in $(update-binfmts --find "$1"); do
              exec -a "$1" "$interpreter" "$@" || RET=$?
          done
          exit "$RET"
          ;;
  esac

That way you could take advantage of binfmt-support's existing interface
for registering binary formats, which is fairly well-tested by this
point, without having to sacrifice non-Linux support.

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #41 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Niels Thykier <niels@thykier.net>

Cc: Wookey <wookey01@arm.com>, 539315@bugs.debian.org, Matthew Johnson <mjj29@debian.org>, Vincent Cheng <vincentc1208@gmail.com>, binfmt-support@packages.debian.org

Subject: Re: Bug#539315: executable-not-elf-or-script test should know about jars

Date: Sat, 9 Jun 2012 15:58:26 +0100

On Sat, Jun 09, 2012 at 12:08:38PM +0200, Niels Thykier wrote:
> My major concern is non-Linux architectures - jarwrapper relies on
> binfmt-support.  Last I checked (a year or more ago) it wasn't available
> on kfreebsd (nor hurd).
>   While it appears to have built there now its description still gives
> me feeling of it being "Linux-only".  Though, I hope Colin can clarify
> binfmt-support's situation on non-Linux archs.

I tried to arrange that the general design should be amenable to a
non-Linux implementation.  That said, it's true that nobody has so far
got round to coming up with one.  I would expect it to be fairly trivial
to write a Hurd implementation, seeing as binfmt_misc is really just a
special case of translators; I don't know what it would take to
implement it on kFreeBSD.

I'd enthusiastically welcome patches from interested developers of
non-Linux ports, although I'm not likely to have time to do it myself.

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #46 received at 539315@bugs.debian.org (full text, mbox, reply):

From: Matthew Johnson <mjj29@debian.org>

To: Colin Watson <cjwatson@debian.org>

Cc: Niels Thykier <niels@thykier.net>, Wookey <wookey01@arm.com>, 539315@bugs.debian.org, Vincent Cheng <vincentc1208@gmail.com>, binfmt-support@packages.debian.org

Subject: Re: Bug#539315: executable-not-elf-or-script test should know about jars

Date: Tue, 12 Jun 2012 10:33:41 +0100

[Message part 1 (text/plain, inline)]

On Sat Jun 09 16:06, Colin Watson wrote:
> On Sat, Jun 09, 2012 at 03:58:26PM +0100, Colin Watson wrote:
> > I tried to arrange that the general design should be amenable to a
> > non-Linux implementation.  That said, it's true that nobody has so far
> > got round to coming up with one.  I would expect it to be fairly trivial
> > to write a Hurd implementation, seeing as binfmt_misc is really just a
> > special case of translators; I don't know what it would take to
> > implement it on kFreeBSD.
> 
> An alternative, incidentally, would be to use a small shim which looks
> something like this (entirely untested):

If I have an executable jar, how do I make the kernel invoke this instead if I
just try and exec it?

(This is the main issue with it working on kfreebsd)

I have tried making jar files with a shbang line at the start, which (IIRC)
works fine on openjdk, but not with gcj. Unfortunately, freebsd is also the
platform that doesn't have working openjdk yet...

Matt

[signature.asc (application/pgp-signature, inline)]

Message #53 received at 539315-close@bugs.debian.org (full text, mbox, reply):

From: Niels Thykier <niels@thykier.net>

To: 539315-close@bugs.debian.org

Subject: Bug#539315: fixed in lintian 2.5.16

Date: Wed, 21 Aug 2013 11:04:08 +0000

Source: lintian
Source-Version: 2.5.16

We believe that the bug you reported is fixed in the latest version of
lintian, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 539315@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Niels Thykier <niels@thykier.net> (supplier of updated lintian package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 21 Aug 2013 12:30:07 +0200
Source: lintian
Binary: lintian
Architecture: source all
Version: 2.5.16
Distribution: unstable
Urgency: low
Maintainer: Debian Lintian Maintainers <lintian-maint@debian.org>
Changed-By: Niels Thykier <niels@thykier.net>
Description: 
 lintian    - Debian package checker
Closes: 539315 637881 679132 690273 708381 711069 713012 717621 717633 718167 718337 718351 718404 718563 718575 718690 718820 718862 719163 719450 719788 720337
Changes: 
 lintian (2.5.16) unstable; urgency=low
 .
   * Summary of tag changes:
     + Added:
       - changelog-is-dh_make-template
       - copyright-should-refer-to-common-license-file-for-apache-2
       - debian-control-repeats-field-name-in-value
       - info-document-missing-image-file
       - license-problem-font-adobe-copyrighted-fragment
       - license-problem-font-adobe-copyrighted-fragment-no-credit
       - missing-dependency-on-libstdc++
       - quilt-patch-using-template-description
     + Removed:
       - dh_pycentral-is-obsolete
       - dh_python-is-obsolete
       - font-adobe-copyrighted-fragment
       - font-adobe-copyrighted-fragment-no-credit
       - init.d-script-call-internal-API
       - missing-dependency-on-python-central
 .
   * checks/apache2.pm:
     + [NT] Fix F-P apache2-deprecated-auth-config for
       "AllowOverride".  Thanks to Jean-Michel Vourgère
       for the report and an initial patch.
       (Closes: #717621)
   * checks/binaries.pm:
     + [NT] Apply patch from Michael Stapelberg to exempt
       golang-go binaries from statically-linked-binary
       tag.  (Closes: #718404)
     + [NT] Permit shared libraries to not link against
       libc as long as they link against libstdc++.  This
       fixes a lot of false positive warnings for some c++
       libraries when the linker (with --as-needed)
       determines that the libc link is superfluous.
       Thanks to Maximiliano Curia for the report.
       (This is a partial fix for #719806)
     + [NT] Add experimental tag for missing dependency
       on libstdc++.
   * checks/changelog-file.{desc,pm}:
     + [BR] Add check for dh-make reminder to insert the
       bug number of the ITP bug.  (Closes: #690273)
   * checks/control-file.{desc,pm}:
     + [BR] Add check for field name being duplicated in
       the value of the field.  (Closes: #711069)
   * checks/copyright-file.{desc,pm}:
     + [BR] Extend check for "reference to compressed
       common-license" to include all current
       common-licenses.
     + [BR] Add check for use of Apache-2.0 in d/copyright
       without references common-licenses.
       (Closes: #713012)
   * checks/cruft.pm:
     + [NT] Skip d/README.Debian and d/README.source when
       checking for non-free licenses.  Mentions here are
       presumably just false-positives.  Thanks to
       Marcelo Jorge Vieira for the report and the initial
       patch.  (Closes: #718575)
   * checks/deb-format.pm:
     + [NT] Apply patch from Guillem Jover to fix a wrong
       tag being emitted on lzma compressed udebs.
       (Closes: #718337)
   * checks/debhelper.{desc,pm}:
     + [NT] Remove tag for dh_pycentral and dh_python being
       obsolete.  Thanks to Luca Falavigna for the report.
       (Closes: #720337)
     + [BR] Fix false-negative in the brace expansion check
       when the comma was next to one of the braces.
       (Closes: #708381)
   * checks/files.{desc,pm}:
     + [NT] Remove tag for missing dependency on
       python-central.  Thanks to Luca Falavigna for the
       report.  (Closes: #718690)
     + [BR] Rename font-adobe-copyrighted-fragment tags.
       (Closes: #718820)
     + [NT] Fix false positive warning about embedded
       feedparser for python3-feedparser.  Thanks to
       Etienne Millon for the report.  (Closes: #719163)
   * checks/infofiles.{desc,pm}:
     + [NT] Apply patches from Kevin Ryde to find info files
       references non-existent images.  (Closes: #719450)
   * checks/init.d.{desc,pm}:
     + [NT] Revert init.d-script-call-internal-API for now.
       Refer to #710559 for more information.
   * checks/patch-systems.{desc,pm}:
     + [BR] Add tag for DEP-3 template descriptions.
       (Closes: #717633)
   * checks/phppear.{desc,pm}:
     + [NT] Apply patch from Mathieu Parent to fix false
       positive missing-pkg-php-tools-addon.  Thanks to
       Thijs Kinkhorst for the report.  (Closes: #718167)
     + [NT] Apply patch form Mathieu Parent to reduce the
       severity of a "composer package" not using
       pkg-php-tools to wishlist.  Thanks to Thijs
       Kinkhorst for the report.  (Closes: #718862)
     + [NT] Apply patch from Vincent Bernat to downgrade
       severity of not using phppear substvars for
       description and synopsis plus explain that they
       should not be used blindly.  Thanks to Mathieu
       Parent for the review of the patch.
       (Closes: #719788)
   * checks/po-debconf.{desc,pm}:
     + [NT] Fix false-positive translated-default-field for
       fields preceded by a "true" Deb822 comment.  Thanks
       to Ron Lee for the report.  (Closes: #637881)
   * checks/scripts.pm:
     + [NT] Stop emitting package-uses-local-diversion for
       calls to dpkg-divert without --package as dpkg 1.16.0
       (Wheezy) handles this case correctly.  Thanks to
       Raphaël Hertzog for the report.  (Closes: #679132)
     + [NT] Apply patch from Vincent Cheng to fix warning
       for executable jar files.  Thanks to Matthew Johnson
       for the report.  (Closes: #539315)
   * checks/systemd.pm:
     + [NT] Apply patch from Stig Sandbeck Mathisen to allow
       systemd files being symlinks to /dev/null.
       (Closes: #718563)
 .
   * debian/changelog:
     + [NT] Correct some older tag summaries to include some
       missing tags in the entry for 2.5.11 and 2.5.12.
   * debian/copyright:
     + [NT] Add Bastien ROUCARIÈS to maintainers (as BR).
 .
   * frontend/lintian:
     + [NT] Move some handling of overrides to Lintian::Tags.
 .
   * lib/Lintian/Processable/Package.pm:
     + [NT] Refuse to process .dsc files that are missing the
       Source field.   This prevents some warnings about using
       undefined values.  Thanks to Guillem Jover for the
       report.  (Closes: #718351)
   * lib/Lintian/Tags.pm:
     + [NT] Take over some handling of overrides from the
       frontend.
   * lib/Lintian/Util.pm:
     + [NT] Fix problem in normalize_pkg_path, where "."-entries
       were not properly filtered out.
 .
   * profiles/debian/ftp-master-auto-reject.profile:
     + [NT] Refresh with new tags.  Thanks to Gregor Herrmann
       for the reminder.
Checksums-Sha1: 
 435b4f940160af0bfe8643000b8142efe8f55764 2573 lintian_2.5.16.dsc
 b267004fce87bae42752ae6ed4fa8b105e08f39c 1249827 lintian_2.5.16.tar.gz
 056a47deb74c79080e20bfd5dc0c6a0f92aeb197 687684 lintian_2.5.16_all.deb
Checksums-Sha256: 
 436389fa459f33539c6afbd6aa3902b4e28162be85199f183a748b0f7dc83cde 2573 lintian_2.5.16.dsc
 961c015a5aefa1e9904e187339ee1d18968ab8205086fa67c419720632dd4ab7 1249827 lintian_2.5.16.tar.gz
 f00462f5608739edbd532fd605d90b632b08d624b4f00440201a0dc7e226882f 687684 lintian_2.5.16_all.deb
Files: 
 8cf3f55588dc60f30efa3ae53bb20b08 2573 devel optional lintian_2.5.16.dsc
 2dbdc658c538dd6c78c9973f57ad662a 1249827 devel optional lintian_2.5.16.tar.gz
 0fe81be17c403f45b54874655e397945 687684 devel optional lintian_2.5.16_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQIcBAEBCAAGBQJSFJz9AAoJEAVLu599gGRC7A4QAJZ2Juj4ZCoGlP0KPAx8H+bs
YRjx+WUMw9bGUUcTmqn+erIMAqHn91J52UBYtMrUX5YjHokZslPtq8qMjT9NLyac
/6r6s4XCiSJOmhZCw6aYeKhlCnttNxzGt1H64lOzRZvWszHb3zbxPE2nDnD6tsWO
9EjZkQCZzORlTVXXQPYE9OgZMmzfAX9cv43cnrunn66Rab3UIfDnzT3wa7DTylWt
cxvuL3SKgkQpQLJ6R3+gfD8NYd+dTQ9fWKLYM5fb0xEMBP9E4CAdcj/seayLyZz8
WH2ufV6H/qsk9qQ8N0P8YPZDv2jchq98D0ZBr7PkS8Qp/w8E3cjN9UaRO65kwl1F
MbMj1N7xjW6pB0vf3hZ+MEfkUbDz8r/Ds7UHzLFPi5JsTHzRE+BC82zow1m7d+rh
dU5KKbglJwnDBY9KbPOIeFyzPJBI2mq5cV3yCBgZA/AL8gedFqKUP5uXdJ7Xs0f/
CvIaanP9gETU0036pCPIZhg+4hDac3zmWEcil5hrSIC5WNT/XXFNc/jVMfk130/O
Fw9tLY+ziCai0UUyWVt/k2dV5UxcFJGj9ZbuNVIAgEryDUrCag+XnhLXkt4hEyIl
T/z5fok4wXME6wOvRLbad7loqq7fleTdLLddbiOYUqiwuo60x6s3XmtXv8XRppKj
/Tv3+utaf5gUqOju1yZl
=roj+
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.