From 5c76c507ebb8b64c8ba5edb64f5bada6337873ce Mon Sep 17 00:00:00 2001 From: itexpert228 <67105314+fdaser1337@users.noreply.github.com> Date: Sat, 14 Mar 2026 20:13:38 +0300 Subject: [PATCH] Fix legacy Makefile install and command validation - Fix install commands to handle Makefiles that don't respect DESTDIR - Add fallback to PREFIX for legacy packages like bzip2 - Remove \n and \t from suspicious characters (valid in shell) - Allow multi-line shell commands for complex install logic --- cmd/install.go | 10 +++++++++- pkg/builder/builder.go | 3 ++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/cmd/install.go b/cmd/install.go index 8273eb6..3859344 100644 --- a/cmd/install.go +++ b/cmd/install.go @@ -1023,10 +1023,18 @@ func autoRecipeFromDebian(src *debian.SourceInfo) *recipe.Recipe { } // Use inline install commands instead of external script to avoid hardcoded paths + // For legacy Makefiles that don't respect DESTDIR, we need to use PREFIX={{pkgdir}}/usr installCommands := []string{ "if [ -f build/cmake_install.cmake ]; then DESTDIR={{pkgdir}} cmake --install build; " + "elif [ -f build/meson-private/coredata.dat ]; then DESTDIR={{pkgdir}} meson install -C build; " + - "elif [ -f Makefile ] || [ -f makefile ] || [ -f GNUmakefile ]; then make DESTDIR={{pkgdir}} PREFIX=/usr install; " + + "elif [ -f Makefile ] || [ -f makefile ] || [ -f GNUmakefile ]; then " + + " # Try DESTDIR first, fall back to PREFIX for legacy Makefiles\n" + + " if make -n DESTDIR={{pkgdir}} PREFIX=/usr install 2>/dev/null | grep -q 'mkdir.*{{pkgdir}}'; then\n" + + " make DESTDIR={{pkgdir}} PREFIX=/usr install;\n" + + " else\n" + + " # Legacy Makefile - use PREFIX directly\n" + + " make PREFIX={{pkgdir}}/usr install;\n" + + " fi; " + "else mkdir -p {{pkgdir}}/usr/bin {{pkgdir}}/usr/lib {{pkgdir}}/usr/include; fi", } diff --git a/pkg/builder/builder.go b/pkg/builder/builder.go index 33eaccc..a0e591b 100644 --- a/pkg/builder/builder.go +++ b/pkg/builder/builder.go @@ -682,7 +682,8 @@ func (b *Builder) validateCommand(command string) error { } // Check for suspicious characters that might indicate injection - suspiciousChars := []string{"\x00", "\r", "\n", "\t"} + // Note: \n (newline) and \t (tab) are valid in shell scripts for multi-line commands + suspiciousChars := []string{"\x00", "\r"} for _, char := range suspiciousChars { if strings.Contains(command, char) { return fmt.Errorf("command contains suspicious character: %q", char)