Bug 29502

Summary: makeself-v2.4.2 creates unnecessary links to files inside its own archive
Product: Mageia Reporter: Alex Kotov <alex_q_2000>
Component: RPM PackagesAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Normal CC: jani.valimaa, marja11
Version: 8   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: makeself-2.4.2-1.mga8.src.rpm CVE:
Status comment:

Description Alex Kotov 2021-09-29 10:14:02 CEST
Description of problem:
---
makeself-v2.4.2 creates unnecessary links to files inside its own archive. This error has been fixed in makeself versions >=2.4.3. Current version = makeself-2.4.5.

How reproducible:
mkdir ~/dir1; cd ~/dir1; touch ./{file1,file2}

1. Makeself version 2.4.2 (Mageia-8)
---
makeself --notemp ~/dir1 mypatch.run "Makeself by Stephane Peter" echo
Header is 667 lines long

About to compress 4 KB of data...
Adding files to archive named "mypatch.run"...
./
./file1
./file2
./file1
./file2
CRC: 1653944648
MD5: 2116916e024f58b775b129fd3f154a7e

Self-extractable archive "mypatch.run" successfully created.

./mypatch.run --list
Target directory: dir1
drwxrwxr-x marsik/marsik     0 2021-09-29 09:54 ./
-rw-rw-r-- marsik/marsik     0 2021-09-29 09:54 ./file1
-rw-rw-r-- marsik/marsik     0 2021-09-29 09:54 ./file2
hrw-rw-r-- marsik/marsik     0 2021-09-29 09:54 ./file1 link to ./file1
hrw-rw-r-- marsik/marsik     0 2021-09-29 09:54 ./file2 link to ./file2

2. New Makeself version 2.4.5 (Mageia-8)
---
makeself --notemp ~/dir1 mypatch.run "Makeself by Stephane Peter" echo
Header is 714 lines long

About to compress 4 KB of data...
Adding files to archive named "mypatch.run"...
./file1
./file2
CRC: 3356094391
MD5: 5b5ce9c15671217334019608df281b63

Self-extractable archive "mypatch.run" successfully created.

./mypatch.run --list
Target directory: dir1
-rw-rw-r-- marsik/marsik     0 2021-09-29 09:54 ./file1
-rw-rw-r-- marsik/marsik     0 2021-09-29 09:54 ./file2
---

New packages makeself-v2.4.5: https://cloud.mail.ru/public/ovrx/XEsMUdzBs

Bonus:
---
SFXSnapshot to create sfx hotfixes: https://github.com/AKotov-dev/SFXSnapshot

GUI it was made only for only for advanced users and uses a built-in script makeself (v2.4.5). It contains 2 launch shortcuts: from a regular user and from root, which allows you to take snapshots of file system objects. It might be useful to someone.

p.s. For BugZilla moderators... I apologize for the fact that my IP address is from the Netherlands. In Russia, the next re-election of themselves (deputies) has recently taken place and I have to encrypt my connection until all this clowning is over.

With respect,
Alex
Comment 1 Marja Van Waes 2021-09-29 20:18:47 CEST
(In reply to Alex Kotov from comment #0)

> 
> p.s. For BugZilla moderators... I apologize for the fact that my IP address
> is from the Netherlands. 

I'm from the Netherlands and I feel flattered ;-)

Assigning to all packagers collectively, because the registered maintainer is temporarily unavailable.

Assignee: bugsquad => pkg-bugs
CC: (none) => marja11

Comment 2 Alex Kotov 2021-09-30 18:29:54 CEST
(In reply to Marja Van Waes from comment #1)
> I'm from the Netherlands...
Well, at least something is constantly in this world... :)

Hello, Marja. :) I am very, very glad to see you again! At last Saint Panteleimon heard my prayers. Happiness and good luck to you in everything, dear, sweet Marja. I could write to you by mail, but our providers are now setting DPI everywhere and blocking important protocols. I've missed you and I'm really glad you're finally back. I hug you tightly and kiss you (in a friendly way)! ;)

Now I need to catch and "kiss" (figuratively speaking) the elusive David Geiger. Did he by any chance run past you there in the Netherlands? Maybe he was too carried away by the work of Van Gogh or was seduced by the delicious cheese? I don't know what to think anymore. :)

Sincerely,
Alex (tags: #MgaRemix/#Raccoon/#Russia)
Comment 3 Alex Kotov 2021-10-01 09:50:02 CEST
Dear Marja...

Additionally, taking the opportunity, I want to inform you that I have successfully left the Mageia Russian community (MRC) and I moved to a more powerful forum dedicated to all kinds of Linux, where I have a separate branch dedicated to assembling live MgaRemix flash drives (derived from Mageia) based on VirtualBox. From time to time I write different programs for MegRemix. Two years ago, after reading the "Logo and trademark policy", the decisions of the council and lengthy consultations, I decided not to get involved with all the subtleties of the Mageia policy. Now I do not promote MgaRemix as a separate, physically existing Mageia derivative, but declare it as a manufacturing technology. All the assemblies that are present there are laid out as an example of MgaRemix technology. Of course, all the previously agreed points with the inability to use logos, screensavers, desktop styles, etc. are as relevant as before. In other words, I decided to fence myself off with an additional "partition" from the possibility of controversial issues related to the "Logo and trademark policy".

I arm all experimental builds with my own software. Now MgaRemix has its own direction: total anonymization and encryption, protection of personal data and privacy of ordinary people. Already now the assemblies contain entry-level security tools: DNSCrypt-GUI (MITM protection, dnscrypt proxy management, encryption), ProtonVPN-GUI (OpenVPN management, connection encryption), Encrypt-Decrypt (encryption/decryption of local files - AES-256, Top Secret), Google Chrome with surveillance disabled and Adblock and WebRTC plugins (ip leak protection). In the future, I plan to implement special iptables rule schemes using trap ports (smart tarpit) as protection against external scanning (in development).

What is happening in Russia is beyond reason and I cannot stay away from what is being done to my country. This is contrary to what my father and mother taught me.

If you accidentally "get lost" :) in the vastness of the Russian network, you can always stop at my site: https://linuxforum.ru/viewtopic.php?id=39704

You are always welcome, no matter what the circumstances. :)

Kind regards,
Alex
Comment 4 Jani Välimaa 2021-10-09 15:37:57 CEST
Please test makeself-2.4.5-1.mga8 from core/updates_testing.

Assignee: pkg-bugs => qa-bugs
CC: (none) => jani.valimaa

Comment 5 Alex Kotov 2021-10-09 19:11:45 CEST
Hi, Jani!

Test makeself-2.4.5-1.mga8.noarch.rpm:
---
rpm -qi makeself
Name        : makeself
Version     : 2.4.5
Release     : 1.mga8
Architecture: noarch
Install Date: Сб 09 окт 2021 19:49:38
Group       : Development/Other
Size        : 86402
License     : GPLv2+
Signature   : RSA/SHA256, Сб 09 окт 2021 16:54:08, Key ID b742fa8b80420f66
Source RPM  : makeself-2.4.5-1.mga8.src.rpm
Build Date  : Сб 09 окт 2021 16:38:03
Build Host  : localhost
Packager    : wally <wally>
Vendor      : Mageia.Org
URL         : http://makeself.io/
Summary     : Make self-extractable archives on Unix
Description :
makeself.sh is a shell script that generates a self-extractable
tar.gz archive from a directory. The resulting file appears as a shell
script, and can be launched as is. The archive will then uncompress
itself to a temporary directory and an arbitrary command will be
executed (for example an installation script). This is pretty similar
to archives generated with WinZip Self-Extractor in the Windows world.

mkdir ~/dir1; cd ~/dir1; touch ./{file1,file2}
makeself --notemp ~/dir1 mypatch.run "Makeself by Stephane Peter" echo
Header is 714 lines long

About to compress 4 KB of data...
Adding files to archive named "mypatch.run"...
./file1
./file2
CRC: 4287055886
MD5: 4994755bb7858c6e4d12cde0a73811e0

Self-extractable archive "mypatch.run" successfully created.

./mypatch.run --list
Target directory: dir1
-rw-r--r-- root/root         0 2021-10-09 19:55 ./file1
-rw-r--r-- root/root         0 2021-10-09 19:55 ./file2

Everything works perfectly! Reverse unpacking of the created SFX also works correctly. Thank you so much for your cooperation. :)

Sincerely,
Alex

Status: NEW => RESOLVED
Resolution: (none) => FIXED