Support ~ in package versions

[Jeff Johnson]

We should support the ~ character in package versions. As far as I know the status is:

* Bitbake supports them
* opkg itself supports them since 2008: http://code.google.com/p/opkg/source/detail?spec=svn40&r=40
* opkg-utils doesn't (e.g. opkg-compare-versions)
* rpm packaging code does not 'invalid tag value("^[A-Za-z0-9+._]+$") Version: Version: 0.20~rc1+git0+fdb6c0402337d9607c7a39155088eaf033742752' from do_package_write_rpm
* Status of other parts of the system is unknown

[Richard-purdie-1 (richard-purdie-1)]

We should support the ~ character in package versions. As far as I know the status is:

* Bitbake supports them
* opkg itself supports them since 2008: http://code.google.com/p/opkg/source/detail?spec=svn40&r=40
* opkg-utils doesn't (e.g. opkg-compare-versions)
* rpm packaging code does not 'invalid tag value("^[A-Za-z0-9+._]+$") Version: Version: 0.20~rc1+git0+fdb6c0402337d9607c7a39155088eaf033742752' from do_package_write_rpm
* Status of other parts of the system is unknown

[Jeff Johnson (n3npq)]

Tracked at https://bugs.launchpad.net/rpm/+bug/1172341

[Ross Burton (ross)]

Also, dpkg supports them.

[Jeff Johnson (n3npq)]

The cited "invalid tag value" problem is a regular expression
that can be modified: add "~" to the permitted characters
in this macro
    %pattern_Version ^[A-Za-z0-9+._~]+$
in the macros file to permit a '~' in Version:.

THe semantic changes to version comparison implied by
twiddle-in-version have been implemented for more than
a year and are present in rpm-5.4.10 (at least).

Whether opkg/opkg-utils/dpkg "support" twiddle in
version is largely irrelevant to rpm: rpm needs
to be self-consistent with its own tool chains.

Very few rpm tools are known to handle twiddle-in-version
correctly.

[Jeff Johnson (n3npq)]

I'm also obligated by full disclosure to point out
the reason (a CVE a few years back) why '~' (and other
characters) were not included in rpm Version: strings.

Many scripts/tools construct shell commands using
values in metadata: rpmbuild is one of those tools,
there are others.

E.g. rpmbuild removes the build tree whose name is constructed
from NVR tags in metadata. Consider this *.spec metadata:
    Name: N
    Version: V~whatever
    Release: R
from which data rpmbuild constructs a command
    rm -rf N-V~whatever
preparing for a build.

All that is needed to trick rpmbuild into removing
one's home directory is an alternative representation
for a space character in some shell context surrounding
the twiddle so that the command becomes
    rm -rf N-V ~ whatever

A closely related exploit that appended ";rm -rf ~" to
the Name: value (but using alternative representations of
the ' ' character was reported to vendor-sec like 4 years ago

[Ross Burton (ross)]

opkg-utils should now be using more shared code so is fixed.

rpm4 supports it.

I think we're close to closing this.

[Ross Burton (ross)]

I've added a selftest that verifies that rpm, dpkg, and opkg all do the right thing with ~ in version comparisons, and a recipe that uses ~ builds correctly:

$ find . -name test-version[-_]1*
./deb/corei7-64/test-version_1.0~beta-r0_amd64.deb
./ipk/corei7-64/test-version_1.0~beta-r0_corei7-64.ipk
./rpm/corei7_64/test-version-1.0~beta-r0.corei7_64.rpm