Sodiff: detect name-embedded-version soname transitions (thrift, LLVM) - #18614
Open
jslobodzian wants to merge 1 commit into
Open
Sodiff: detect name-embedded-version soname transitions (thrift, LLVM)#18614jslobodzian wants to merge 1 commit into
jslobodzian wants to merge 1 commit into
Conversation
Sodiff normalized only versions trailing ".so" (libfoo.so.<ver>), so libraries that bake the version into the base name (libthrift-0.24.0.so, libLLVM-18.so) were treated as brand-new libraries. Their predecessor was never found, the --whatrequires dependent scan was skipped, and orphaned dependents (e.g. parquet-libs still requiring libthrift-0.15.0.so after the thrift 0.15->0.24 bump in PR #18239) passed the check -- later breaking dependent builds such as ceph (seen in PR #18543). Derive the version-independent .so "family" for both SONAME styles when locating a published predecessor and its requirers. Bug: 23439 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 17152c7d-ff27-432d-b038-1ad05da30e3c
microsoft-github-policy-service
Bot
added
Tools
fasttrack/3.0
Collaborator
Author
|
/azurepipelines run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 1 pipeline(s) were filtered out due to trigger conditions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Sodiff's ABI check compares built-package sonames against the published base repo (
azurelinux-official-base.repo-> packages.microsoft.com prod/base), which is correct. But its version-normalization step only strips a version that trails.so(conventionallibfoo.so.<ver>):sofile_no_ver=$(echo "$sofile" | sed -E 's/[.]so[(.].+/.so/')Libraries that bake the version into the base name -- Apache Thrift (
libthrift-0.24.0.so), LLVM (libLLVM-18.so) -- keep their version after this sed. The predecessor lookup--whatprovides "libthrift-0.24.0.so*"then cannot match the publishedlibthrift-0.15.0.so, so Sodiff concludes "brand-new library, no predecessor," skips the entire--whatrequiresdependent scan, and exits clean.Real-world impact
thrift was bumped 0.15.0 -> 0.24.0 in #18239 (14-CVE HIGH). Sodiff passed. But published
parquet-libs-15.0.0-8(a libarrow subpackage) still hard-requiredlibthrift-0.15.0.so()(64bit)and became uninstallable. ~3.5 weeks later this surfaced as a red build in #18543 (libevent) when its dependentcephcouldn't dep-install parquet-libs. Fixed out-of-band by the libarrow rebuild #18554.The thrift naming is expected, not a bug -- the spec documents it: "thrift versions their libraries by package version, so each version change is a SONAME change and dependencies need to be rebuilt." Sodiff must handle this class.
Fix
Derive the version-independent
.sofamily for both SONAME styles before the predecessor/requirer lookups:libfoo.so.<ver>->libfoo.so(unchanged behavior)libfoo-<ver>.so->libfoo-*.so(new)Validation
Simulated PMC provide-set harness:
libthrift-0.24.0.so(0.15->0.24)libssl.so.4(conventional 3->4)libLLVM-18.so(17->18)libbrandnew.so(truly new)bash -nclean.Follow-up (not in this PR)
Bug #23439 also proposes a
dnf repoclosuregate (baseline-diff over the built overlay + published tier repos) as defense-in-depth -- it catches any unresolvedRequires, not just soname-shaped ones. Tracked separately.Bug: #23439