Opened 21 months ago

Last modified 2 months ago

#67161 assigned defect

ipmitool @1.8.19: fetches a file at build time

Reported by: ryandesign (Ryan Carsten Schmidt) Owned by: drkp (Dan Ports)
Priority: Normal Milestone:
Component: ports Version: 2.8.1
Keywords: Cc:
Port: ipmitool

Description

The ipmitool build system downloads the URL http://www.iana.org/assignments/enterprise-numbers.txt and installs it as /opt/local/share/misc/enterprise-numbers. This means the port's build is not reproducible: somebody who installs the port today won't necessarily get the same software as if they install it next week, if the contents of that URL change by then. It also means the successful build of the port is at the mercy of a third-party web site, whose structure could change; see #67156 where this did happen.

The solution, as always, is for the portfile to specify all of the files it needs, along with their checksums, and for the build system to use the file MacPorts fetched rather than fetching its own copy. The port's revision should be increased, and the checksums updated, whenever the upstream URL changes. The URL is unversioned, which presents a set of surmountable challenges. A method such as the one employed by the curl-ca-bundle port could be used. I can make these changes to the ipmitool Portfile if you agree with the idea.

Change History (2)

comment:1 Changed 2 months ago by joshenders (Josh Enders)

+1 thanks for opening this

comment:2 Changed 2 months ago by drkp (Dan Ports)

I didn't realize it was doing this (and somehow missed this ticket til now). If anyone wants to make the necessary changes to fix this, go ahead. Otherwise, I'll take care of it, but no promises on when I will be able to find time.

Note: See TracTickets for help on using tickets.