mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

buildtools-tarball: fix unbound variable issues under 'set -u'

Browse Source 
When Bash runs with 'set -u' (nounset), accessing an unset variable
directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable"
error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR
is never triggered and the script aborts.

The current code assumes these variables may be unset or empty, but does
not guard against 'set -u'. This breaks builds in stricter shell
environments or when users explicitly enable 'set -u'.

Fix this by using parameter expansion with a default value, e.g.
"${SSL_CERT_FILE:-}", so that unset variables are treated as empty
strings. This preserves the intended logic (respect host env first, then
CAFILE/CAPATH, then buildtools defaults) and makes the script robust
under 'set -u'.

(From OE-Core rev: 4cf131ebd157b79226533b5a5074691dd0e1a4ab)

Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Haixiao Yan
2025-09-16 21:19:18 +08:00
committed by Steve Sakoman
parent 54578cd039
commit e3ce89324d
4 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
meta/recipes-connectivity/openssl/files/environment.d-openssl.sh
View File

@@ -4,16 +4,16 @@ export OPENSSL_ENGINES="$OECORE_NATIVE_SYSROOT/usr/lib/engines-3"
# Respect host env SSL_CERT_FILE/SSL_CERT_DIR first, then auto-detected host cert, then cert in buildtools
# CAFILE/CAPATH is auto-deteced when source buildtools
if [ -z "$SSL_CERT_FILE" ]; then
if [ -n "$CAFILE" ];then
if [ -z "${SSL_CERT_FILE:-}" ]; then
if [ -n "${CAFILE:-}" ];then
export SSL_CERT_FILE="$CAFILE"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export SSL_CERT_FILE="$OECORE_NATIVE_SYSROOT/usr/lib/ssl/certs/ca-certificates.crt"
fi
fi
if [ -z "$SSL_CERT_DIR" ]; then
if [ -n "$CAPATH" ];then
if [ -z "${SSL_CERT_DIR:-}" ]; then
if [ -n "${CAPATH:-}" ];then
export SSL_CERT_DIR="$CAPATH"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export SSL_CERT_DIR="$OECORE_NATIVE_SYSROOT/usr/lib/ssl/certs"

8
meta/recipes-devtools/git/git/environment.d-git.sh
View File

@@ -1,15 +1,15 @@
# Respect host env GIT_SSL_CAINFO/GIT_SSL_CAPATH first, then auto-detected host cert, then cert in buildtools
# CAFILE/CAPATH is auto-deteced when source buildtools
if [ -z "$GIT_SSL_CAINFO" ]; then
if [ -n "$CAFILE" ];then
if [ -z "${GIT_SSL_CAINFO:-}" ]; then
if [ -n "${CAFILE:-}" ];then
export GIT_SSL_CAINFO="$CAFILE"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export GIT_SSL_CAINFO="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt"
fi
fi
if [ -z "$GIT_SSL_CAPATH" ]; then
if [ -n "$CAPATH" ];then
if [ -z "${GIT_SSL_CAPATH:-}" ]; then
if [ -n "${CAPATH:-}" ];then
export GIT_SSL_CAPATH="$CAPATH"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export GIT_SSL_CAPATH="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs"

4
meta/recipes-devtools/python/python3-requests/environment.d-python3-requests.sh
View File

@@ -1,7 +1,7 @@
# Respect host env REQUESTS_CA_BUNDLE first, then auto-detected host cert, then cert in buildtools
# CAFILE/CAPATH is auto-deteced when source buildtools
if [ -z "$REQUESTS_CA_BUNDLE" ]; then
if [ -n "$CAFILE" ];then
if [ -z "${REQUESTS_CA_BUNDLE:-}" ]; then
if [ -n "${CAFILE:-}" ];then
export REQUESTS_CA_BUNDLE="$CAFILE"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export REQUESTS_CA_BUNDLE="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt"

8
meta/recipes-support/curl/curl/environment.d-curl.sh
View File

@@ -1,15 +1,15 @@
# Respect host env CURL_CA_BUNDLE/CURL_CA_PATH first, then auto-detected host cert, then cert in buildtools
# CAFILE/CAPATH is auto-deteced when source buildtools
if [ -z "$CURL_CA_PATH" ]; then
if [ -n "$CAFILE" ];then
if [ -z "${CURL_CA_PATH:-}" ]; then
if [ -n "${CAFILE:-}" ];then
export CURL_CA_BUNDLE="$CAFILE"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export CURL_CA_BUNDLE="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt"
fi
fi
if [ -z "$CURL_CA_PATH" ]; then
if [ -n "$CAPATH" ];then
if [ -z "${CURL_CA_PATH:-}" ]; then
if [ -n "${CAPATH:-}" ];then
export CURL_CA_PATH="$CAPATH"
elif [ -e "${OECORE_NATIVE_SYSROOT}/etc/ssl/certs/ca-certificates.crt" ];then
export CURL_CA_PATH="${OECORE_NATIVE_SYSROOT}/etc/ssl/certs"