Add tainting support to buildroot
v4 cover Add tainting support to buildroot
Packages that need to resolve dependencies internally and use a package manager would harm the reproducibility of a build, moreover they escape the legal infrastructure not giving enough informations on licensing.
This patch adds a tainting mechanism in the form of a variable FOO_TAINTS that can be used to signal that a package harms the reproducibility or licensing under certain conditions.
This opens the door to include per language dependency managers in buildroot.
Angelo Compagnucci (3):
Makefile: add tainting support
docs/manual: adding infos about tainting package/nodejs: taint the build on external modules
Makefile | 10 ++++++++++ docs/manual/adding-packages-generic.txt | 6 ++++++ docs/manual/legal-notice.txt | 12 ++++++++++++ package/nodejs/nodejs.mk | 1 + package/pkg-generic.mk | 12 ++++++++++++ 5 files changed, 41 insertions(+)
Signature · 1 line
2.7.4
PATCH v4 1/3 Makefile: add tainting support
Packages who harms the build reproducibility or licensing can declare FOO_TAINTS variable. If a package taints the build it will be added to a list of tainting packages. The build ends with a warning if the tainting packages list is not empty. Moreover, legal info will show a warning in presence of a tainting package.
Angelo Compagnucci <[email protected]>
--- Makefile | 10 ++++++++++ package/pkg-generic.mk | 12 ++++++++++++ 2 files changed, 22 insertions(+)
Makefile +10 -0
@@ -758,12 +758,21 @@ endif touch $(TARGET_DIR)/usr +.PHONY: check-tainted +check-tainted: +ifneq ($(BR2_TAINTED_BY),) + $(error Your buildroot configuration is tainted by: $(BR2_TAINTED_BY)) +else + @echo "Your buildroot configuration is not tainted" +endif + .PHONY: target-post-image target-post-image: $(TARGETS_ROOTFS) target-finalize @rm -f $(ROOTFS_COMMON_TAR) @$(foreach s, $(call qstrip,$(BR2_ROOTFS_POST_IMAGE_SCRIPT)), \ $(call MESSAGE,"Executing post-image script $(s)"); \ $(EXTRA_ENV) $(s) $(BINARIES_DIR) $(call qstrip,$(BR2_ROOTFS_POST_SCRIPT_ARGS))$(sep)) + $(if $(BR2_TAINTED_BY), at echo "WARNING: Your buildroot configuration is tainted by: $(BR2_TAINTED_BY).") .PHONY: source source: $(foreach p,$(PACKAGES),$(p)-all-source)
@@ -1070,6 +1079,7 @@ help: @echo ' source - download all sources needed for offline-build' @echo ' external-deps - list external packages used' @echo ' legal-info - generate info about license compliance' + @echo ' check-tainted - check if any selected package harms build reproducibility or licensing' @echo ' printvars - dump all the internal variables' @echo @echo ' make V=0|1 - 0 => quiet build (default), 1 => verbose build'
package/pkg-generic.mk +12 -0
@@ -870,6 +870,12 @@ else $(2)_KCONFIG_VAR = BR2_PACKAGE_$(2) endif +ifdef $(2)_TAINTS +ifeq ($$($$($(2)_KCONFIG_VAR)),y) +BR2_TAINTED_BY+=$$($(2)_RAWNAME) +endif +endif + # legal-info: declare dependencies and set values used later for the manifest ifneq ($$($(2)_LICENSE_FILES),) $(2)_MANIFEST_LICENSE_FILES = $$($(2)_LICENSE_FILES)
@@ -909,6 +915,12 @@ else $(Q)$$(foreach F,$$($(2)_LICENSE_FILES),$$(call legal-license-file,$$($(2)_RAWNAME),$$($(2)_BASENAME_RAW),$$($(2)_PKGDIR),$$(F),$$($(2)_DIR)/$$(F),$$(call UPPERCASE,$(4)))$$(sep)) endif # license files +ifeq ($$(call qstrip,$$($(2)_TAINTS)),YES) +ifeq ($$($$($(2)_KCONFIG_VAR)),y) + $(Q)$$(call legal-warning-pkg,$$($(2)_RAWNAME),unknown license for additional modules or dependencies) +endif +endif + ifeq ($$($(2)_SITE_METHOD),local) # Packages without a tarball: don't save and warn @$$(call legal-warning-nosource,$$($(2)_RAWNAME),local)
Signature · 1 line
2.7.4
PATCH v4 2/3 docs/manual: adding infos about tainting
In reply to Angelo CompagnucciFrom: Angelo Compagnucci <[email protected]>
Adding documentation about the usage of LIBFOO_TAINTS and "make check-tainted".
--- docs/manual/adding-packages-generic.txt | 6 ++++++ docs/manual/legal-notice.txt | 12 ++++++++++++ 2 files changed, 18 insertions(+)
docs/manual/adding-packages-generic.txt +6 -0
@@ -445,6 +445,12 @@ not and can not work as people would expect it should: to let you know, and +not saved+ will appear in the +license files+ field of the manifest file for this package. +* +LIBFOO_TAINTS+ shoud be set to YES if a package taints a Buildroot + configuration. A Buildroot configuration is tainted when a packages uses + external dependencies for which Buildroot cannot clearly recover licensing + informations. If a configuration is tainted, it means that the licensing + information produced by +make legal-info+ could not be accurate. + * +LIBFOO_ACTUAL_SOURCE_TARBALL+ only applies to packages whose +LIBFOO_SITE+ / +LIBTOO_SOURCE+ pair points to an archive that does not actually contain source code, but binary code. This a very
docs/manual/legal-notice.txt +12 -0
@@ -73,6 +73,18 @@ distribution is required). When you run +make legal-info+, Buildroot produces warnings in the +README+ file to inform you of relevant material that could not be saved. +Furthermore, a Buildroot configuration could be tainted from a package that uses +some custom external dependencies from the Buildroot tree. An example could be +a package manager for a software stack that downloads the required dependencies +during the building of a package. In such cases, Buildroot cannot check the +licensing of the downloaded software and thus giving accurate licensing +informations. +To check if your configuration is tainted, run: + +-------------------- +make check-tainted +-------------------- + Finally, keep in mind that the output of +make legal-info+ is based on declarative statements in each of the packages recipes. The Buildroot developers try to do their best to keep those declarative statements as
Signature · 1 line
2.7.4
PATCH v4 3/3 package/nodejs: taint the build on external modules
In reply to Angelo CompagnucciThis patch enables the tainting of the build when an external module is added.
--- package/nodejs/nodejs.mk | 1 + 1 file changed, 1 insertion(+)
package/nodejs/nodejs.mk +1 -0
@@ -160,6 +160,7 @@ NPM = $(TARGET_CONFIGURE_OPTS) \ # We can only call NPM if there's something to install. # ifneq ($(NODEJS_MODULES_LIST),) +NODEJS_TAINTS = YES define NODEJS_INSTALL_MODULES # If you're having trouble with module installation, adding -d to the # npm install call below and setting npm_config_rollback=false can both
Signature · 1 line
2.7.4