1#!/usr/bin/env python3 2# 3# Copyright OpenEmbedded Contributors 4# 5# SPDX-License-Identifier: GPL-2.0-only 6# 7 8import sys, os, subprocess, re, shutil 9 10allowed = ( 11 # type is supported by dash 12 'if type systemctl >/dev/null 2>/dev/null; then', 13 'if type systemd-tmpfiles >/dev/null 2>/dev/null; then', 14 'type update-rc.d >/dev/null 2>/dev/null; then', 15 'command -v', 16 # HOSTNAME is set locally 17 'buildhistory_single_commit "$CMDLINE" "$HOSTNAME"', 18 # False-positive, match is a grep not shell expression 19 'grep "^$groupname:[^:]*:[^:]*:\\([^,]*,\\)*$username\\(,[^,]*\\)*"', 20 # TODO verify dash's '. script args' behaviour 21 '. $target_sdk_dir/${oe_init_build_env_path} $target_sdk_dir >> $LOGFILE' 22 ) 23 24def is_allowed(s): 25 for w in allowed: 26 if w in s: 27 return True 28 return False 29 30SCRIPT_LINENO_RE = re.compile(r' line (\d+) ') 31BASHISM_WARNING = re.compile(r'^(possible bashism in.*)$', re.MULTILINE) 32 33def process(filename, function, lineno, script): 34 import tempfile 35 36 if not script.startswith("#!"): 37 script = "#! /bin/sh\n" + script 38 39 fn = tempfile.NamedTemporaryFile(mode="w+t") 40 fn.write(script) 41 fn.flush() 42 43 try: 44 subprocess.check_output(("checkbashisms.pl", fn.name), universal_newlines=True, stderr=subprocess.STDOUT) 45 # No bashisms, so just return 46 return 47 except subprocess.CalledProcessError as e: 48 # TODO check exit code is 1 49 50 # Replace the temporary filename with the function and split it 51 output = e.output.replace(fn.name, function) 52 if not output or not output.startswith('possible bashism'): 53 # Probably starts with or contains only warnings. Dump verbatim 54 # with one space indention. Can't do the splitting and allowed 55 # checking below. 56 return '\n'.join([filename, 57 ' Unexpected output from checkbashisms.pl'] + 58 [' ' + x for x in output.splitlines()]) 59 60 # We know that the first line matches and that therefore the first 61 # list entry will be empty - skip it. 62 output = BASHISM_WARNING.split(output)[1:] 63 # Turn the output into a single string like this: 64 # /.../foobar.bb 65 # possible bashism in updatercd_postrm line 2 (type): 66 # if ${@use_updatercd(d)} && type update-rc.d >/dev/null 2>/dev/null; then 67 # ... 68 # ... 69 result = [] 70 # Check the results against the allowed list 71 for message, source in zip(output[0::2], output[1::2]): 72 if not is_whitelisted(source): 73 if lineno is not None: 74 message = SCRIPT_LINENO_RE.sub(lambda m: ' line %d ' % (int(m.group(1)) + int(lineno) - 1), 75 message) 76 result.append(' ' + message.strip()) 77 result.extend([' %s' % x for x in source.splitlines()]) 78 if result: 79 result.insert(0, filename) 80 return '\n'.join(result) 81 else: 82 return None 83 84def get_tinfoil(): 85 scripts_path = os.path.dirname(os.path.realpath(__file__)) 86 lib_path = scripts_path + '/lib' 87 sys.path = sys.path + [lib_path] 88 import scriptpath 89 scriptpath.add_bitbake_lib_path() 90 import bb.tinfoil 91 tinfoil = bb.tinfoil.Tinfoil() 92 tinfoil.prepare() 93 # tinfoil.logger.setLevel(logging.WARNING) 94 return tinfoil 95 96if __name__=='__main__': 97 import argparse, shutil 98 99 parser = argparse.ArgumentParser(description='Bashim detector for shell fragments in recipes.') 100 parser.add_argument("recipes", metavar="RECIPE", nargs="*", help="recipes to check (if not specified, all will be checked)") 101 parser.add_argument("--verbose", default=False, action="store_true") 102 args = parser.parse_args() 103 104 if shutil.which("checkbashisms.pl") is None: 105 print("Cannot find checkbashisms.pl on $PATH, get it from https://salsa.debian.org/debian/devscripts/raw/master/scripts/checkbashisms.pl") 106 sys.exit(1) 107 108 # The order of defining the worker function, 109 # initializing the pool and connecting to the 110 # bitbake server is crucial, don't change it. 111 def func(item): 112 (filename, key, lineno), script = item 113 if args.verbose: 114 print("Scanning %s:%s" % (filename, key)) 115 return process(filename, key, lineno, script) 116 117 import multiprocessing 118 pool = multiprocessing.Pool() 119 120 tinfoil = get_tinfoil() 121 122 # This is only the default configuration and should iterate over 123 # recipecaches to handle multiconfig environments 124 pkg_pn = tinfoil.cooker.recipecaches[""].pkg_pn 125 126 if args.recipes: 127 initial_pns = args.recipes 128 else: 129 initial_pns = sorted(pkg_pn) 130 131 pns = set() 132 scripts = {} 133 print("Generating scripts...") 134 for pn in initial_pns: 135 for fn in pkg_pn[pn]: 136 # There's no point checking multiple BBCLASSEXTENDed variants of the same recipe 137 # (at least in general - there is some risk that the variants contain different scripts) 138 realfn, _, _ = bb.cache.virtualfn2realfn(fn) 139 if realfn not in pns: 140 pns.add(realfn) 141 data = tinfoil.parse_recipe_file(realfn) 142 for key in data.keys(): 143 if data.getVarFlag(key, "func") and not data.getVarFlag(key, "python"): 144 script = data.getVar(key, False) 145 if script: 146 filename = data.getVarFlag(key, "filename") 147 lineno = data.getVarFlag(key, "lineno") 148 # There's no point in checking a function multiple 149 # times just because different recipes include it. 150 # We identify unique scripts by file, name, and (just in case) 151 # line number. 152 attributes = (filename or realfn, key, lineno) 153 scripts.setdefault(attributes, script) 154 155 156 print("Scanning scripts...\n") 157 for result in pool.imap(func, scripts.items()): 158 if result: 159 print(result) 160 tinfoil.shutdown() 161