Re: [PATCH 1/3] fetcher: quote filenames given in commands

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Fri, 2012-04-13 at 16:06 +0200, Enrico Scholz wrote:
> Filenames were given as-is to shell commands. This causes problems
> when names contain characters which have a special meaning. E.g. when
> having a local systemd unit
> 
> | SRC_URI = "file://etc-machine\20id.mount"
> 
> the fetcher failed with
> 
> | NOTE: Unpacking .../etc-machine\20id.mount to ...
> | cp: cannot stat `.../etc-machine20id.mount': No such file or directory
> 
> Patch uses the pipes.quote() function to apply shell escaping.  These
> changes are not really complete; they are modifying __init__.py only
> but most fetchers need similar adaptations too.
> 
> Signed-off-by: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
> ---
>  lib/bb/fetch2/__init__.py |   38 +++++++++++++++++++++-----------------
>  1 files changed, 21 insertions(+), 17 deletions(-)

Whilst I understand what you're trying to fix, I'm afraid I don't like
the patch. I'd prefer to have one way of building these commands, rather
than two different ones with the shell=isinstance(cmd, basestring)
check.

We're stabilising for release at the moment and I don't have enough
confidence in these patches at this point in the cycle, particularly
since you change runfetchcmd but not other users in other fetch methods
other than git. I'm planning to hold off these until after that and even
then, I'd like to find a cleaner approach that doesn't involve
runfetchcmd2.

Cheers,

Richard