[133076] trunk/dports/multimedia/VLC

[Joshua Root]

On 2015-2-20 11:16 , Ryan Schmidt wrote:
> On Feb 19, 2015, at 1:43 PM, mf2k at macports.org wrote:
>>
>> Revision
>> 133076
>> Author
>> mf2k at macports.org
>> Date
>> 2015-02-19 11:43:20 -0800 (Thu, 19 Feb 2015)
>> Log Message
>>
>> vlc: Move pulseaudio to a variant. Enable qt4 ui plugin. Remove some sparkle code. Update configure options to match upstream recommended ones. (#46748)
> 
>> Modified: trunk/dports/multimedia/VLC/Portfile (133075 => 133076)
> 
>> +            # the vlc executable needs to be started with a full path to the app bundle executable
>> +            # or else the Mac OS X interface will hang beyond even a ^C or ^\ :
>> +            file delete ${destroot}${prefix}/bin/vlc
>> +            set vlc [open "${filespath}/vlc" "w"]
>> +            puts ${vlc} "#!/bin/sh"
>> +            puts ${vlc} ""
>> +            puts ${vlc} "exec ${applications_dir}/VLC.app/Contents/MacOS/VLC \"$@\""
>> +            close ${vlc}
>> +            xinstall -m 755 ${filespath}/vlc ${destroot}${prefix}/bin
> 
> A port should not attempt to modify (or create or delete) a file in filespath, nor anywhere outside of worksrcpath (except perhaps for copying default configuration files in a post-activate block).
> 
> The usual way to accomplish what you're doing here would be to have a script in the files directory, which you would commit to the repository as normal, containing the desired script, with the path to the applications directory represented by the placeholder "@APPLICATIONS_DIR@". The port installs the file where it needs to go in the destroot, then uses reinplace to replace the placeholder with its final value.

You shouldn't even be able to write to ${filespath}, it just happens
that (a) this is the destroot phase so we're running as root, and (b)
you're using Tcl commands (as opposed to something run via system) so
sandboxing isn't applied.

That should be considered a bug in base, albeit not an easy one to fix.

- Josh