[Bug 227027] devel/qt5: insecure file perms in the pkg tarballs

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=227027

--- Comment #7 from commit-hook at freebsd.org ---
A commit references this bug:

Author: adridg
Date: Thu Jan  2 22:08:28 UTC 2020
New revision: 521884
URL: https://svnweb.freebsd.org/changeset/ports/521884

Log:
  MFH: r521876

  Fix up file permissions in Qt ports.

  Because qt-dist.mk sets EXTRACT_AFTER_ARGS, the framework-standard
  --no-same-owner and --no-same-permissions aren't added. That means
  that the files end up in packages with the permissions from the tarball,
  and in particular that official packages contain group-writable (wheel)
  includes (C++ headers) and other files.

  This was reported in
        https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=227027
  and fixed in 465911 (18 months ago) but the move from bsd.qt.mk
  to Uses/qt-dist.mk lost those settings again. Re-add them to
  the Uses/ file to improve package security.

  (The problem does not seem to be present in my local poudriere builds)

  PR:           227027
  Reported by:  grarpamp at gmail.com
  Reviewed by:  tcberner
  Approved by:  tcberner
  Differential Revision:        https://reviews.freebsd.org/D22999

  Approved by:  portmgr (joneum)

Changes:
_U  branches/2020Q1/
  branches/2020Q1/Mk/Uses/qt-dist.mk

-- 
You are receiving this mail because:
You are the assignee for the bug.