8000 harden the source · opencv/opencv-python@d364ab3 · GitHub
[go: up one dir, main page]

Skip to content

Commit d364ab3

Browse files
committed
harden the source
1 parent c744b5a commit d364ab3

File tree

1 file changed

+22
-16
lines changed

1 file changed

+22
-16
lines changed

travis_osx_brew_cache.sh

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
# Library to cache downloaded and locally-built Homebrew bottles in Travis OSX build.
22

3-
trap '{ sleep 1; #if we terminale too abruptly, Travis will lose some log output
3+
_BREW_ERREXIT='
4+
set -e -o pipefail
5+
trap '\''{ sleep 3; #if we terminale too abruptly, Travis will lose some log output
46
exit 2; #The trap isn''t called in the parent function, so can''t use `return` here.
57
#`exit` will terminate the entire build but it seems we have no choice.
6-
}' ERR
7-
set -E
8+
}'\'' ERR
9+
set -E'
810

911
#Should be in Travis' cache
1012
BREW_LOCAL_BOTTLE_METADATA="$HOME/local_bottle_metadata"
@@ -30,19 +32,20 @@ function brew_install_and_cache_within_time_limit {
3032
# use bottle if available, build and cache bottle if not.
3133
# Terminate and exit with status 1 if this takes too long.
3234
# Exit with status 2 on any other error.
35+
( eval "$_BREW_ERREXIT"
3336

34-
local PACKAGE; PACKAGE="${1:?}"
35-
local TIME_LIMIT;TIME_LIMIT=${2:-$BREW_TIME_LIMIT}
36-
local TIME_HARD_LIMIT;TIME_HARD_LIMIT=${3:-$BREW_TIME_HARD_LIMIT}
37-
local TIME_START;TIME_START=${4:-$BREW_TIME_START}
37+
local PACKAGE; PACKAGE="${1:?}" || return 2
38+
local TIME_LIMIT;TIME_LIMIT=${2:-$BREW_TIME_LIMIT} || return 2
39+
local TIME_HARD_LIMIT;TIME_HARD_LIMIT=${3:-$BREW_TIME_HARD_LIMIT} || return 2
40+
local TIME_START;TIME_START=${4:-$BREW_TIME_START} || return 2
3841

3942
local BUILD_FROM_SOURCE INCLUDE_BUILD
4043

4144
_brew_is_bottle_available "$PACKAGE" || BUILD_FROM_SOURCE=1
4245
[ -n "$BUILD_FROM_SOURCE" ] && INCLUDE_BUILD="--include-build" || true
4346

4447
# Whitespace is illegal in package names so converting all whitespace into single spaces due to no quotes is okay.
45-
DEPS=`brew deps "$PACKAGE" $INCLUDE_BUILD`
48+
DEPS=`brew deps "$PACKAGE" $INCLUDE_BUILD` || return 2
4649
for dep in $DEPS; do
4750
#TIME_LIMIT only has to be met if we'll be actually building the main project this iteration, i.e. after the "root" module installation
4851
#While we don't know that yet, we can make better use of Travis-given time with a laxer limit
@@ -51,8 +54,10 @@ function brew_install_and_cache_within_time_limit {
5154
done
5255

5356
_brew_check_slow_building_ahead "$PACKAGE" "$TIME_START" "$TIME_HARD_LIMIT" || return $?
54-
_brew_install_and_cache "$PACKAGE" "$([[ -z "$INCLUDE_BUILD" ]] && echo 1 || echo 0)"
57+
_brew_install_and_cache "$PACKAGE" "$([[ -z "$INCLUDE_BUILD" ]] && echo 1 || echo 0)" || return 2
5558
_brew_check_elapsed_build_time "$TIME_START" "$TIME_LIMIT" || return $?
59+
) \
60+
|| if test $? -eq 1; then brew_go_bootstrap_mode; return 1; else return 2; fi #must run this in current process
5661
}
5762

5863
function brew_add_local_bottles {
@@ -220,9 +225,8 @@ function brew_go_bootstrap_mode {
220225
#Internal functions
221226

222227
function _brew_parse_bottle_json {
223-
# Parse JSON info about a package
224-
# from `brew info --json=v1` input or a JSON file on stdin
225-
# and save it into bash global variables specified in arguments
228+
# Parse JSON file resulting from `brew bottle --json`
229+
# and save data into specified variables
226230

227231
local JSON; JSON="${1:?}"; shift
228232

@@ -247,20 +251,22 @@ function _brew_parse_bottle_json {
247251

248252
function _brew_parse_package_info {
249253
# Get and parse `brew info --json` about a package
250-
# and save it into bash variables specified in arguments
254+
# and save data into specified variables
251255

252256
local PACKAGE; PACKAGE="${1:?}"; shift
253257
local OS_CODENAME;OS_CODENAME="${1:?}"; shift
254258

255259
local JSON_DATA; JSON_DATA=$(python2.7 -c 'if True:
256260
import sys, json, subprocess; j=json.loads(subprocess.check_output(("brew","info","--json=v1",sys.argv[1])))
257261
data=j[0]
258-
print data["versions"]["stable"]
262+
revision=data["revision"]
263+
# in bottle''s json, revision is included into version; here, they are separate
264+
print data["versions"]["stable"]+("_"+str(revision) if revision else "")
259265
bottle_data=data["bottle"]["stable"]
260266
print bottle_data["rebuild"]
261-
print bottle_data["files"].get(sys.argv[2],{"sha256":""})["sha256"]
267+
print bottle_data["files"].get(sys.argv[2],{"sha256":"!?"})["sha256"] #prevent losing trailing blank line to command substitution
262268
' \
263-
"$PACKAGE" "$OS_CODENAME")
269+
"$PACKAGE" "$OS_CODENAME"); JSON_DATA="${JSON_DATA%\!\?}" #!? can't occur in a hash
264270

265271
unset PACKAGE OS_CODENAME
266272

0 commit comments

Comments
 (0)
0