Custom Query (204 matches)

We have a very old version 3.12.8 back from 2010. A newer version is required by many projects including poppler and Mozilla itself.

There is a fundamental problem in Unix-like shells when run under OS/2: backslashes in PATH-like environment variables. The backslashes will be interpreted as escape sequences by the shell in many cases which will produce incorrect results.

Examples of such cases include:

• Unquoted strings in shell scripts where backslashes will be simply dropped. E.g sh -c '\abc\def.exe' will try to start abcdef.exe).
• Special escape processing by the echo built-in. E.g. dash echo will treat backspaces as escape chars in ANSI escape sequences and will eat them/replace with special characters. Some other shells like mksh behave the same way which makes echo generally unsafe/unportable.

These cases are very common so a global solution is required — otherwise you have to patch each script to make path strings quoted and/or replace echo with an external expr command but this sounds like a really bad alternative.

The obvious solution is to fix all well-known PATH-like environment variables at the beginning of shell execution by replacing backslashes with slashes. The only drawback here is the in theory a PATH-like variable may be treated differently by a script but for variables like PATH/TMPDIR etc this is very unlikely (and even wrong) because they have a well-defined global system meaning so it looks safe to patch them. Another potential problem is custom script-specific variables that also contain paths but this is something we can't cover. A good idea is to introduce an environment variable recognized by shells that will contain the names of all PATH-like environment variables to fix (and that will default to PATH/TMPDIR etc).

The current ca-certificates bundle dates from 2011. Since then, Fedora has actually modified its bundle from the stock Mozilla one to retain trust status for some older ones for compatibility reasons. We should determine whether these inclusions in the Fedora project are worth maintaining or whether we should simply package the Mozilla bundle for distribution on OS/2.

Links:

​https://fedoraproject.org/wiki/CA-Certificates ​https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/ ​https://lists.mozilla.org/listinfo/dev-security-policy ​https://wiki.mozilla.org/CA:FAQ

It should be noted that Fedora includes a script to toggle between the Fedora bundle and the Mozilla bundle, too.