By default, the "vendor" area is not used, so Perl's installation procedure forgot to create its top-level paths, too. In OpenPKG we use the "vendor" area, so make sure it is created the same way the "site" area is. Index: installperl --- installperl.orig 2009-08-14 00:40:10 +0200 +++ installperl 2009-08-24 09:37:51 +0200 @@ -197,6 +197,8 @@ my $installarchlib = "$opts{destdir}$Config{installarchlib}"; my $installsitelib = "$opts{destdir}$Config{installsitelib}"; my $installsitearch = "$opts{destdir}$Config{installsitearch}"; +my $installvendorlib = "$opts{destdir}$Config{installvendorlib}"; +my $installvendorarch = "$opts{destdir}$Config{installvendorarch}"; my $installman1dir = "$opts{destdir}$Config{installman1dir}"; my $man1ext = $Config{man1ext}; my $libperl = $Config{libperl}; @@ -356,6 +358,8 @@ mkpath($installarchlib, $opts{verbose}, 0777); mkpath($installsitelib, $opts{verbose}, 0777) if ($installsitelib); mkpath($installsitearch, $opts{verbose}, 0777) if ($installsitearch); +mkpath($installvendorlib, $opts{verbose}, 0777) if ($installvendorlib); +mkpath($installvendorarch, $opts{verbose}, 0777) if ($installvendorarch); if (chdir "lib") { $do_installarchlib = ! samepath($installarchlib, '.'); ----------------------------------------------------------------------------- By default, the Perl module search order is "use lib, -I, PERL[5]LIB, perl, site, vendor, other". This means that in OpenPKG both the modules installed via CPAN shell (in "site" area) and the "perl-xxx" packages (in "vendor" area) cannot override the (sometimes obsoleted) module versions distributed with Perl (in "perl" area). Hence, we change the search order to a more reasonable one for OpenPKG: "use lib, -I, PERL[5]LIB, site, vendor, perl, other". Index: perl.c --- perl.c.orig 2009-04-22 20:07:41 +0200 +++ perl.c 2009-08-24 09:36:28 +0200 @@ -4879,39 +4879,6 @@ incpush(APPLLIB_EXP, TRUE, TRUE, TRUE, TRUE); #endif -#ifdef ARCHLIB_EXP - incpush(ARCHLIB_EXP, FALSE, FALSE, TRUE, TRUE); -#endif -#ifdef MACOS_TRADITIONAL - { - Stat_t tmpstatbuf; - SV * privdir = newSV(0); - char * macperl = PerlEnv_getenv("MACPERL"); - - if (!macperl) - macperl = ""; - - Perl_sv_setpvf(aTHX_ privdir, "%slib:", macperl); - if (PerlLIO_stat(SvPVX(privdir), &tmpstatbuf) >= 0 && S_ISDIR(tmpstatbuf.st_mode)) - incpush(SvPVX(privdir), TRUE, FALSE, TRUE, FALSE); - Perl_sv_setpvf(aTHX_ privdir, "%ssite_perl:", macperl); - if (PerlLIO_stat(SvPVX(privdir), &tmpstatbuf) >= 0 && S_ISDIR(tmpstatbuf.st_mode)) - incpush(SvPVX(privdir), TRUE, FALSE, TRUE, FALSE); - - SvREFCNT_dec(privdir); - } - if (!PL_tainting) - incpush(":", FALSE, FALSE, TRUE, FALSE); -#else -#ifndef PRIVLIB_EXP -# define PRIVLIB_EXP "/usr/local/lib/perl5:/usr/local/lib/perl" -#endif -#if defined(WIN32) - incpush(PRIVLIB_EXP, TRUE, FALSE, TRUE, TRUE); -#else - incpush(PRIVLIB_EXP, FALSE, FALSE, TRUE, TRUE); -#endif - #ifdef SITEARCH_EXP /* sitearch is always relative to sitelib on Windows for * DLL-based path intuition to work correctly */ @@ -4954,6 +4921,39 @@ incpush(PERL_VENDORLIB_STEM, FALSE, TRUE, TRUE, TRUE); #endif +#ifdef ARCHLIB_EXP + incpush(ARCHLIB_EXP, FALSE, FALSE, TRUE, TRUE); +#endif +#ifdef MACOS_TRADITIONAL + { + Stat_t tmpstatbuf; + SV * privdir = newSV(0); + char * macperl = PerlEnv_getenv("MACPERL"); + + if (!macperl) + macperl = ""; + + Perl_sv_setpvf(aTHX_ privdir, "%slib:", macperl); + if (PerlLIO_stat(SvPVX(privdir), &tmpstatbuf) >= 0 && S_ISDIR(tmpstatbuf.st_mode)) + incpush(SvPVX(privdir), TRUE, FALSE, TRUE, FALSE); + Perl_sv_setpvf(aTHX_ privdir, "%ssite_perl:", macperl); + if (PerlLIO_stat(SvPVX(privdir), &tmpstatbuf) >= 0 && S_ISDIR(tmpstatbuf.st_mode)) + incpush(SvPVX(privdir), TRUE, FALSE, TRUE, FALSE); + + SvREFCNT_dec(privdir); + } + if (!PL_tainting) + incpush(":", FALSE, FALSE, TRUE, FALSE); +#else +#ifndef PRIVLIB_EXP +# define PRIVLIB_EXP "/usr/local/lib/perl5:/usr/local/lib/perl" +#endif +#if defined(WIN32) + incpush(PRIVLIB_EXP, TRUE, FALSE, TRUE, TRUE); +#else + incpush(PRIVLIB_EXP, FALSE, FALSE, TRUE, TRUE); +#endif + #ifdef PERL_OTHERLIBDIRS incpush(PERL_OTHERLIBDIRS, TRUE, TRUE, TRUE, TRUE); #endif ----------------------------------------------------------------------------- Port to [Open]Darwin 6.6.2: 1. In OpenPKG, Perl does not use the vendor GCC and our GCC does not understand "-no-cpp-precomp", so remove this build option. 2. The indirectly includes system specific headers which in turn have fields named "environ" while Perl uses a define of "environ" internally. So wrap the inclusion. 3. Darwin 6 no longer accepts the non-standard "#import" statements, so replace with "#include" and circumvent some header problem related to the non-standard "__private_extern__" attribute. Index: hints/darwin.sh --- hints/darwin.sh.orig 2009-04-14 20:38:15 +0200 +++ hints/darwin.sh 2009-08-24 09:36:28 +0200 @@ -120,9 +120,6 @@ *-2147483648) ccflags="${ccflags} -DINT32_MIN_BROKEN -DINT64_MIN_BROKEN" ;; esac -# Avoid Apple's cpp precompiler, better for extensions -cppflags="${cppflags} -no-cpp-precomp" - # This is necessary because perl's build system doesn't # apply cppflags to cc compile lines as it should. ccflags="${ccflags} ${cppflags}" @@ -182,8 +179,7 @@ esac ldlibpthname='DYLD_LIBRARY_PATH'; -# useshrplib=true results in much slower startup times. -# 'false' is the default value. Use Configure -Duseshrplib to override. +useshrplib='true' cat > UU/archname.cbu <<'EOCBU' # This script UU/archname.cbu will get 'called-back' by Configure Index: ext/DynaLoader/dl_dyld.xs --- ext/DynaLoader/dl_dyld.xs.orig 2009-04-15 22:51:42 +0200 +++ ext/DynaLoader/dl_dyld.xs 2009-08-24 09:36:28 +0200 @@ -47,7 +47,13 @@ #undef environ #undef bool +#ifdef PERL_DARWIN +#define __private_extern__ extern +#include +#undef __private_extern__ +#else #import +#endif static char *dlerror() { Index: perlio.c --- perlio.c.orig 2009-04-15 01:47:25 +0200 +++ perlio.c 2009-08-24 09:36:28 +0200 @@ -474,7 +474,14 @@ #include #endif #ifdef HAS_MMAP +#ifdef PERL_DARWIN +#define environ_safe environ +#undef environ #include +#define environ environ_safe +#else +#include +#endif #endif void ----------------------------------------------------------------------------- Port to Tru64 5.1: Under Tru64 our gcc has to be built without binutils and the system ld(1) does not accept a "-O" option, so remove the whole passing of optimization flags to ld(1). Under a brain-dead platform like Tru64 we really don't need any more optimization because we are already happy if it works at all. Index: hints/dec_osf.sh --- hints/dec_osf.sh.orig 2009-02-12 23:58:12 +0100 +++ hints/dec_osf.sh 2009-08-24 09:36:28 +0200 @@ -73,15 +73,6 @@ *) if $test "X$optimize" = "X$undef"; then lddlflags="$lddlflags -msym" else - case "$myosvers" in - *4.0D*) - # QAR 56761: -O4 + .so may produce broken code, - # fixed in 4.0E or better. - ;; - *) - lddlflags="$lddlflags $optimize" - ;; - esac # -msym: If using a sufficiently recent /sbin/loader, # keep the module symbols with the modules. lddlflags="$lddlflags -msym $_lddlflags_strict_ansi" ----------------------------------------------------------------------------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0976 Multiple scripts in the perl package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files. Index: lib/CGI/Cookie.pm --- lib/CGI/Cookie.pm.orig 2009-02-12 23:58:12 +0100 +++ lib/CGI/Cookie.pm 2009-08-24 09:36:28 +0200 @@ -470,7 +470,7 @@ You may also retrieve cookies that were stored in some external form using the parse() class method: - $COOKIES = `cat /usr/tmp/Cookie_stash`; + $COOKIES = `cat /var/run/www/Cookie_stash`; %cookies = parse CGI::Cookie($COOKIES); If you are in a mod_perl environment, you can save some overhead by Index: lib/Shell.pm --- lib/Shell.pm.orig 2009-02-12 23:58:16 +0100 +++ lib/Shell.pm 2009-08-24 09:36:28 +0200 @@ -151,7 +151,7 @@ use Shell qw(cat ps cp); $passwd = cat('new; ----------------------------------------------------------------------------- Linker flag change for Solaris. Index: Configure --- Configure.orig 2009-08-18 21:03:53 +0200 +++ Configure 2009-08-24 09:36:28 +0200 @@ -8056,7 +8056,7 @@ ;; linux|irix*|gnu*) dflt="-shared $optimize" ;; next) dflt='none' ;; - solaris) dflt='-G' ;; + solaris) dflt='-shared' ;; sunos) dflt='-assert nodefinitions' ;; svr4*|esix*|nonstopux) dflt="-G $ldflags" ;; *) dflt='none' ;; ----------------------------------------------------------------------------- Security Fix (CVE-2005-3962, OpenPKG-SA-2005.025-perl) Index: sv.c --- sv.c.orig 2009-08-05 16:48:19 +0200 +++ sv.c 2009-08-24 09:36:28 +0200 @@ -9163,7 +9163,10 @@ if ( (width = expect_number(&q)) ) { if (*q == '$') { ++q; - efix = width; + if (width > PERL_INT_MAX) + efix = PERL_INT_MAX; + else + efix = width; } else { goto gotwidth; } ----------------------------------------------------------------------------- Do not use -fstack-protector as it causes too much portability issues. Index: Configure --- Configure.orig 2009-08-24 09:42:33 +0200 +++ Configure 2009-08-24 13:01:27 +0200 @@ -5140,17 +5140,6 @@ ;; esac - # on x86_64 (at least) we require an extra library (libssp) in the - # link command line. This library is not named, so I infer that it is - # an implementation detail that may change. Hence the safest approach - # is to add the flag to the flags passed to the compiler at link time, - # as that way the compiler can do the right implementation dependant - # thing. (NWC) - case "$gccversion" in - ?*) set stack-protector -fstack-protector - eval $checkccflag - ;; - esac ;; esac @@ -5289,15 +5278,6 @@ ;; *) dflt="$ldflags";; esac -# See note above about -fstack-protector -case "$ccflags" in -*-fstack-protector*) - case "$dflt" in - *-fstack-protector*) ;; # Don't add it again - *) dflt="$dflt -fstack-protector" ;; - esac - ;; -esac : Try to guess additional flags to pick up local libraries. for thislibdir in $libpth; do @@ -8085,14 +8065,6 @@ ''|' ') dflt='none' ;; esac - case "$ldflags" in - *-fstack-protector*) - case "$dflt" in - *-fstack-protector*) ;; # Don't add it again - *) dflt="$dflt -fstack-protector" ;; - esac - ;; - esac rp="Any special flags to pass to $ld to create a dynamically loaded library?" ----------------------------------------------------------------------------- Make sure we install into /lib/perl/ and not /lib/perl5/ Index: Configure --- Configure.orig 2009-08-24 18:33:49 +0200 +++ Configure 2009-08-24 18:44:39 +0200 @@ -1756,7 +1756,7 @@ touch posthint.sh : set package name -package='perl5' +package='perl' first=`echo $package | sed -e 's/^\(.\).*/\1/'` last=`echo $package | sed -e 's/^.\(.*\)/\1/'` case "`echo AbyZ | tr '[:lower:]' '[:upper:]' 2>/dev/null`" in ----------------------------------------------------------------------------- Linking against just libgdbm_compat under at least SUSE fails because it also needs libgdbm (which Perl doesn't pick up, too) Index: hints/linux.sh --- hints/linux.sh.orig 2009-02-12 23:58:12 +0100 +++ hints/linux.sh 2009-09-09 21:01:05 +0200 @@ -55,7 +55,9 @@ libswanted="$*" # Debian 4.0 puts ndbm in the -lgdbm_compat library. -libswanted="$libswanted gdbm_compat" +if [ -f /etc/debian_version -o -f /etc/ubuntu_version ]; then + libswanted="$libswanted gdbm_compat" +fi # If you have glibc, then report the version for ./myconfig bug reporting. # (Configure doesn't need to know the specific version since it just uses