anacondarecipes / ncurses-feedstock

A conda-smithy repository for ncurses.

About ncurses

Home: http://www.gnu.org/software/ncurses/

Package license: Free software (MIT-like)

Feedstock license: BSD 3-Clause

Summary: Library for text-based user interfaces

Current build status

Linux: OSX: Windows:

Current release info

Version: Downloads:

Installing ncurses

Installing ncurses from the conda-forge channel can be achieved by adding conda-forge to your channels with:

conda config --add channels conda-forge

Once the conda-forge channel has been enabled, ncurses can be installed with:

conda install ncurses

It is possible to list all of the versions of ncurses available on your platform with:

conda search ncurses --channel conda-forge

About conda-forge

conda-forge is a community-led conda channel of installable packages. In order to provide high-quality builds, the process has been automated into the conda-forge GitHub organization. The conda-forge organization contains one repository for each of the installable packages. Such a repository is known as a feedstock.

A feedstock is made up of a conda recipe (the instructions on what and how to build the package) and the necessary configurations for automatic building using freely available continuous integration services. Thanks to the awesome service provided by CircleCI, AppVeyor and TravisCI it is possible to build and upload installable packages to the conda-forge Anaconda-Cloud channel for Linux, Windows and OSX respectively.

To manage the continuous integration and simplify feedstock maintenance conda-smithy has been developed. Using the conda-forge.yml within this repository, it is possible to re-render all of this feedstock's supporting files (e.g. the CI configuration files) with conda smithy rerender.

Terminology

feedstock - the conda recipe (raw material), supporting scripts and CI configuration.

conda-smithy - the tool which helps orchestrate the feedstock. Its primary use is in the construction of the CI .yml files and simplify the management of many feedstocks.

conda-forge - the place where the feedstock and smithy live and work to produce the finished article (built conda distributions)

Updating ncurses-feedstock

If you would like to improve the ncurses recipe or build a new package version, please fork this repository and submit a PR. Upon submission, your changes will be run on the appropriate platforms to give the reviewer an opportunity to confirm that the changes result in a successful build. Once merged, the recipe will be re-built and uploaded automatically to the conda-forge channel, whereupon the built conda packages will be available for everybody to install and use from the conda-forge channel. Note that all branches in the conda-forge/ncurses-feedstock are immediately built and any created packages are uploaded, so PRs should be based on branches in forks and branches in the main repository should only be used to build distinct package versions.

In order to produce a uniquely identifiable distribution:

• If the version of a package is not being increased, please add or increase the build/number.
• If the version of a package is being increased, please remember to return the build/number back to 0.

ncurses-feedstock's Issues

Updating recipe to include fix for CVE-2022-29458

It appears that updating ncurses-feedstock recipe to include fix for CVE-2022-29458 may be a bit complicated. The fix is specifically in the following commit: mirror/ncurses@4c9f63c. However, if I were to convert this commit alone to a patch and apply it to source code checked out using v6.3 tag, it fails.

Should ncurses-feedstock be updated where instead of checking out 6.3, it specifically checks out the snapshot at that particular commit to include the CVE fix? Even if that's possible, I imagine it's not the right approach because it no longer is 6.3 but 6.4.alpha. I don't know if this is one of those instances where fixing the CVE can only be done when ncurses v6.4 is made available.

@katietz @tobijk @chenghlee @remkade what are your thoughts?

lib/terminfo not in taball

in the "fixing permissions" process

...
    setting rpath to: $ORIGIN/.
Warning: rpath /usr/local/conda-bld/ncurses_1515469404486/_build_env/lib is outside prefix /usr/local/conda-bld/ncurses_1515469404486/_h_env_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_place (removing it)
patchelf: file: /usr/local/conda-bld/ncurses_1515469404486/_h_env_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_place/lib/libtinfow.so.6.0
    setting rpath to: $ORIGIN/.
Warning: rpath /usr/local/conda-bld/ncurses_1515469404486/_build_env/lib is outside prefix /usr/local/conda-bld/ncurses_1515469404486/_h_env_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_place (removing it)
patchelf: file: /usr/local/conda-bld/ncurses_1515469404486/_h_env_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_place/lib/libpanelw.so.6.0
    setting rpath to: $ORIGIN/.
Fixing permissions
Detected hard-coded path in binary file share/terminfo/v/vt525
Detected hard-coded path in binary file share/terminfo/w/wsvt25
Detected hard-coded path in binary file share/terminfo/w/wsvt25m
Detected hard-coded path in binary file share/terminfo/x/x68k
Detected hard-coded path in binary file share/terminfo/z/z29a
Detected hard-coded path in binary file share/terminfo/z/z29a-kc-uc
Detected hard-coded path in binary file share/terminfo/z/z29a-nkc-bc
Detected hard-coded path in binary file share/terminfo/z/z29a-nkc-uc
Detected hard-coded path in binary file share/terminfo/z/z340
Detected hard-coded path in binary file share/terminfo/z/z340-nam
'lib/terminfo' not in tarball
Traceback (most recent call last):
  File "/usr/local/bin/conda-build", line 11, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.6/site-packages/conda_build/cli/main_build.py", line 393, in main
    execute(sys.argv[1:])
  File "/usr/local/lib/python3.6/site-packages/conda_build/cli/main_build.py", line 384, in execute
    verify=args.verify)
  File "/usr/local/lib/python3.6/site-packages/conda_build/api.py", line 186, in build
    need_source_download=need_source_download, config=config, variants=variants)
  File "/usr/local/lib/python3.6/site-packages/conda_build/build.py", line 1909, in build_tree
    notest=notest,
  File "/usr/local/lib/python3.6/site-packages/conda_build/build.py", line 1341, in build
    built_package = bundlers[output_d.get('type', 'conda')](output_d, m, env)
  File "/usr/local/lib/python3.6/site-packages/conda_build/build.py", line 854, in bundle_conda
    tarcheck.check_all(tmp_path, metadata.config)
  File "/usr/local/lib/python3.6/site-packages/conda_build/tarcheck.py", line 89, in check_all
    x.info_files()
  File "/usr/local/lib/python3.6/site-packages/conda_build/tarcheck.py", line 53, in info_files
    raise Exception('info/files')

  File "/usr/local/lib/python3.6/site-packages/conda_build/api.py", line 186, in build
    need_source_download=need_source_download, config=config, variants=variants)
  File "/usr/local/lib/python3.6/site-packages/conda_build/build.py", line 1909, in build_tree
    notest=notest,
  File "/usr/local/lib/python3.6/site-packages/conda_build/build.py", line 1341, in build
    built_package = bundlers[output_d.get('type', 'conda')](output_d, m, env)
  File "/usr/local/lib/python3.6/site-packages/conda_build/build.py", line 854, in bundle_conda
    tarcheck.check_all(tmp_path, metadata.config)
  File "/usr/local/lib/python3.6/site-packages/conda_build/tarcheck.py", line 89, in check_all
    x.info_files()
  File "/usr/local/lib/python3.6/site-packages/conda_build/tarcheck.py", line 53, in info_files
    raise Exception('info/files')

lib/terminfo is a directory. how did it manifest as a file in the tarball?

CVE-2021-39537 in ncurses 6.2

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.
https://nvd.nist.gov/vuln/detail/CVE-2021-39537

run_test.sh checks for the existence of files that do not exist in the package

Osx:
I ran into a situation where tests fail in run_test.sh:
test -f ${PREFIX}/lib/pkgconfig/form.pc
test -f ${PREFIX}/lib/pkgconfig/menu.pc
test -f ${PREFIX}/lib/pkgconfig/ncurses++.pc
test -f ${PREFIX}/lib/pkgconfig/ncurses.pc
test -f ${PREFIX}/lib/pkgconfig/panel.pc
test -f ${PREFIX}/lib/pkgconfig/tinfo.pc

The problem is that these files do not exist, but the tests check for this.
I just downloaded the package, unpacked it and looked at the contents ncurses-6.3-hca72f7f_2/lib/pkgconfig:

The same things for linux:
run_test.sh contain symbolic link and file exist checks:
test -L ${PREFIX}/include/cursesapp.h
test -L ${PREFIX}/include/ncurses/cursesapp.h
test -L ${PREFIX}/include/ncursesw/cursesapp.h
test -f ${PREFIX}/include/cursesf.h
test -L ${PREFIX}/include/ncurses/cursesf.h
test -L ${PREFIX}/include/ncursesw/cursesf.h
test -f ${PREFIX}/include/cursesm.h
test -L ${PREFIX}/include/ncurses/cursesm.h
test -L ${PREFIX}/include/ncursesw/cursesm.h
test -f ${PREFIX}/include/cursesp.h
test -L ${PREFIX}/include/ncurses/cursesp.h
test -L ${PREFIX}/include/ncursesw/cursesp.h
test -f ${PREFIX}/include/cursesw.h
test -L ${PREFIX}/include/ncurses/cursesw.h
test -L ${PREFIX}/include/ncursesw/cursesw.h
test -f ${PREFIX}/include/cursslk.h
test -L ${PREFIX}/include/ncurses/cursslk.h
test -L ${PREFIX}/include/ncursesw/cursslk.h
test -f ${PREFIX}/include/etip.h
test -L ${PREFIX}/include/ncurses/etip.h
test -L ${PREFIX}/include/ncursesw/etip.h

but for example unpacked contents ncurses-6.3-h7f8727e_2/include:

My question is, do these tests really need to be included in run_test.sh if the files themselves are not inside the package?