{"action":"created","issue":{"url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/issues/39","repository_url":"https://api.github.com/repos/openSUSE/obs-service-source_validator","labels_url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/issues/39/comments","events_url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/issues/39/events","html_url":"https://github.com/openSUSE/obs-service-source_validator/pull/39","id":168768658,"number":39,"title":"Don't use rpmbuild to extract sources, patches etc. from a spec","user":{"login":"marcus-h","id":1067596,"avatar_url":"https://avatars.githubusercontent.com/u/1067596?v=3","gravatar_id":"","url":"https://api.github.com/users/marcus-h","html_url":"https://github.com/marcus-h","followers_url":"https://api.github.com/users/marcus-h/followers","following_url":"https://api.github.com/users/marcus-h/following{/other_user}","gists_url":"https://api.github.com/users/marcus-h/gists{/gist_id}","starred_url":"https://api.github.com/users/marcus-h/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcus-h/subscriptions","organizations_url":"https://api.github.com/users/marcus-h/orgs","repos_url":"https://api.github.com/users/marcus-h/repos","events_url":"https://api.github.com/users/marcus-h/events{/privacy}","received_events_url":"https://api.github.com/users/marcus-h/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-08-01T23:51:52Z","updated_at":"2016-08-02T11:41:44Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/pulls/39","html_url":"https://github.com/openSUSE/obs-service-source_validator/pull/39","diff_url":"https://github.com/openSUSE/obs-service-source_validator/pull/39.diff","patch_url":"https://github.com/openSUSE/obs-service-source_validator/pull/39.patch"},"body":"Using rpmbuild is \"insecure\", because during macro expansion arbitrary\r\ncode can be executed (\"%(...)\"). The newly added helpers/spec_sources\r\nscript relies on the Build/Rpm.pm package, which doesn't expand such\r\nmacros. This fixes boo#938556."},"comment":{"url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/issues/comments/236879635","html_url":"https://github.com/openSUSE/obs-service-source_validator/pull/39#issuecomment-236879635","issue_url":"https://api.github.com/repos/openSUSE/obs-service-source_validator/issues/39","id":236879635,"user":{"login":"marcus-h","id":1067596,"avatar_url":"https://avatars.githubusercontent.com/u/1067596?v=3","gravatar_id":"","url":"https://api.github.com/users/marcus-h","html_url":"https://github.com/marcus-h","followers_url":"https://api.github.com/users/marcus-h/followers","following_url":"https://api.github.com/users/marcus-h/following{/other_user}","gists_url":"https://api.github.com/users/marcus-h/gists{/gist_id}","starred_url":"https://api.github.com/users/marcus-h/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcus-h/subscriptions","organizations_url":"https://api.github.com/users/marcus-h/orgs","repos_url":"https://api.github.com/users/marcus-h/repos","events_url":"https://api.github.com/users/marcus-h/events{/privacy}","received_events_url":"https://api.github.com/users/marcus-h/received_events","type":"User","site_admin":false},"created_at":"2016-08-02T11:41:44Z","updated_at":"2016-08-02T11:41:44Z","body":"On 2016-08-02 03:05:21 -0700, Ruediger Oertel wrote:\n> well, basically a very good idea. what I can see is, that\n> - the \"Icon\" implementation is removed in 20-files-present-and-referenced but not added\n> in the helper script\n\nIt is part of the helper script (see sub write_sources), but it depends\non this PR https://github.com/openSUSE/obs-build/pull/283. If you like\nwe can also use \"old\" code, but I thought it might be \"cleaner\"\nif Build::Rpm::parse does the job:)\n\n> - now if we use Build::Rpm::parse, why do we need this catastrophic sed call at all anymore,\n> can't we get rid of the whole mess now ?\n> \nSome parts of it are still needed, for instance, the all the\n%if, %ifarch etc. rewrites (otherwise Build::Rpm::parse might\nfail to detect some sources (yes... with the current implementation\nit is also possible, but only for pathological spec files IMHO;) )).\nShould I try to clean it up a bit?\n"}}
{"actor":{"display_login":"marcus-h"}}