From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id A68111387B1 for ; Sat, 18 Oct 2014 17:36:08 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 61366E0A6B; Sat, 18 Oct 2014 17:36:05 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 82827E0A63 for ; Sat, 18 Oct 2014 17:36:04 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 8E62B34031E for ; Sat, 18 Oct 2014 17:36:02 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id E7AEA82E1 for ; Sat, 18 Oct 2014 17:35:59 +0000 (UTC) From: "Markos Chandras" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Markos Chandras" Message-ID: <1409759463.2a7d19973f0713e66b38b7af04a263ae248fe7ca.hwoarang@gentoo> Subject: [gentoo-commits] proj/devmanual:master commit in: ebuild-writing/functions/ X-VCS-Repository: proj/devmanual X-VCS-Files: ebuild-writing/functions/text.xml X-VCS-Directories: ebuild-writing/functions/ X-VCS-Committer: hwoarang X-VCS-Committer-Name: Markos Chandras X-VCS-Revision: 2a7d19973f0713e66b38b7af04a263ae248fe7ca X-VCS-Branch: master Date: Sat, 18 Oct 2014 17:35:59 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 24ed7381-f0fe-4854-9161-a321a1b70ea4 X-Archives-Hash: 77f9e11df6b2dce5a4bbaf42e6070b67 commit: 2a7d19973f0713e66b38b7af04a263ae248fe7ca Author: W. Trevor King tremily us> AuthorDate: Wed Sep 3 01:15:44 2014 +0000 Commit: Markos Chandras gentoo org> CommitDate: Wed Sep 3 15:51:03 2014 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/devmanual.git;a=commit;h=2a7d1997 ebuild-writing/functions: Don't allow network access There have been a number of bugs filed to remove network access from ebuild phases [1,2,...], but until now this policy was undocumented here. We'll have to relax this restriction if the src_fetch [3,4,5] or pkg_fetch [6] proposals being discussed for EAPI-6 are accepted, but neither is currently mentioned in either the PMS [7] or Portage [8]. Portage *does* have a network-sandbox feature [9,10], which applies to all src_* phases except src_unpack (for live ebuilds). I think it should be applied to pkg_* phases too, but Michał thinks they may need networking "for some kind of IPC" [11]. Alexis pointed out that a strict network-sandbox will break distcc [12], but since that network access is the result of enabling a Portage feature (and not initiated by the ebuild or package itself), it falls outside the scope of this policy. [1]: https://bugs.gentoo.org/show_bug.cgi?id=315403 Summary: media-video/jubler fails to build without network [2]: https://bugs.gentoo.org/show_bug.cgi?id=336771 Summary: dev-libs/libevent tests require network access [3]: https://bugs.gentoo.org/show_bug.cgi?id=182028 Summary: [Future EAPI] About managing CVS/SUBVERSION version of software [4]: http://thread.gmane.org/gmane.linux.gentoo.devel/47645/focus=52918 From: Marijn Schouten gentoo.org> Subject: src_fetch (was Re: EAPI 1 (Was: Re: Monthly Gentoo Council Reminder for April)) Date: 2007-11-09 17:41:38 GMT [5]: http://thread.gmane.org/gmane.linux.gentoo.devel/87869 From: Michał Górny gentoo.org> Subject: [EAPI 6] src_fetch() for fetching live sources Date: 2013-08-27 10:01:27 GMT [6]: http://thread.gmane.org/gmane.linux.gentoo.devel/87869/focus=878773 From: Ian Stakenvicius gentoo.org> Subject: Re: [EAPI 6] src_fetch() for fetching live sources Date: 2013-08-27 14:33:27 GMT [7]: git://git.overlays.gentoo.org/proj/pms.git [8]: git://git.overlays.gentoo.org/proj/portage.git [9]: http://thread.gmane.org/gmane.linux.gentoo.devel/87641 From: Michał Górny gentoo.org> Subject: New developer features in portage: cgroup, network-sandbox, ipc-sandbox Date: 2013-08-20 10:26:03 GMT [10]: http://thread.gmane.org/gmane.linux.gentoo.devel/91131 From: Michał Górny gentoo.org> Subject: RFC: enabling ipc-sandbox & network-sandbox by default Date: 2014-05-11 21:42:38 GMT [11]: http://article.gmane.org/gmane.linux.gentoo.devel/87641 From: Michał Górny gentoo.org> Subject: New developer features in portage: cgroup, network-sandbox, ipc-sandbox Date: 2013-08-20 10:26:03 GMT [12]: http://thread.gmane.org/gmane.linux.gentoo.devel/87641/focus=87658 From: Alexis Ballier gentoo.org> Subject: Re: New developer features in portage: cgroup, network-sandbox, ipc-sandbox Date: 2013-08-20 15:04:35 GMT --- ebuild-writing/functions/text.xml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ebuild-writing/functions/text.xml b/ebuild-writing/functions/text.xml index 09a910e..d10a51f 100644 --- a/ebuild-writing/functions/text.xml +++ b/ebuild-writing/functions/text.xml @@ -35,6 +35,19 @@ When testing or debugging, you can instruct Portage to execute a specific functi from an ebuild by using the ebuild command, see the ebuild(1) manual page for further information.

+ +

+Downloading a package's source happens before any of these phases, so +emerge --fetchonly should perform all the network access you +need (unless you're using live ebuilds). Network access outside of +this would not be cached locally (e.g. in ${DISTDIR}, see +), +which makes it hard to have reproducible builds (see +). +Avoid network access in any phase by using local files, extending +SRC_URI (see +), etc. +