Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SR-15515] Initial Swift Toolchain DEB package testing for Official Debian/Ubuntu repository compliance. #57820

Open
futurejones opened this issue Nov 23, 2021 · 3 comments
Assignees
Labels
bug A deviation from expected or documented behavior. Also: expected but undesirable behavior.

Comments

@futurejones
Copy link
Contributor

Previous ID SR-15515
Radar None
Original Reporter @futurejones
Type Bug
Additional Detail from JIRA
Votes 0
Component/s Project Infrastructure
Labels Bug
Assignee @shahmishal
Priority Medium

md5: 146a1bc497b75232bf01671f3a236418

Issue Description:

A test DEB package was created from the official Swift.org Ubuntu/Focal toolchain release.

Details here - swift-installer-scripts #62

The package was then tested using the debian package testing tool Lintian.

Test Output

// test deb package
~/deb_package_tests$ lintian -i -v swift-5.5.1-RELEASE-ubuntu20.04.deb
N: Using profile ubuntu/main.
N: Starting on group swiftlang/5.5.1
N: Unpacking packages in group swiftlang/5.5.1
N: Finished processing group swiftlang/5.5.1
N: ----
N: Processing binary package swiftlang
N: (version 5.5.1, arch amd64) ...
E: swiftlang: binary-or-shlib-defines-rpath usr/bin/lldb /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
N: 
N:    The binary or shared library sets RPATH or RUNPATH. This overrides the
N:    normal library search path, possibly interfering with local policy and
N:    causing problems for multilib, among other issues.
N:    
N:    The only time a binary or shared library in a Debian package should set
N:    RPATH or RUNPATH is if it is linked to private shared libraries in the
N:    same package. In that case, place those private shared libraries in
N:    /usr/lib/<package>. Libraries used by binaries in other packages should
N:    be placed in /lib or /usr/lib as appropriate, with a proper SONAME, in
N:    which case RPATH/RUNPATH is unnecessary.
N:    
N:    To fix this problem, look for link lines like:
N:        gcc test.o -o test -Wl,--rpath,/usr/local/lib
N:    or
N:        gcc test.o -o test -R/usr/local/lib
N:    and remove the -Wl,--rpath or -R argument. You can also use the chrpath
N:    utility to remove the RPATH.
N:    
N:    Refer to https://wiki.debian.org/RpathIssue for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: binary-or-shlib-defines-rpath usr/bin/lldb-argdumper /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/bin/lldb-server /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/bin/plutil /home/build-user/build/buildbot_linux/swift-linux-x86_64/lib/swift/linux
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/clang/10.0.0/lib/linux/libclang_rt.memprof-x86_64.so /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_minimal-x86_64.so /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/liblldb.so.10.0.0git /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: changelog-file-missing-in-native-package
N: 
N:    Each Debian package (which provides a /usr/share/doc/<pkg> directory)
N:    has to install a changelog file. Since this package seems to be a native
N:    Debian package (i.e., there is no upstream source), the file should
N:    usually be installed as /usr/share/doc/<pkg>/changelog.gz
N:    
N:    Note that Lintian may emit this tag if the changelog exists, but it does
N:    not look like a Debian changelog.
N:    
N:    Refer to Debian Policy Manual section 12.7 (Changelog files and release
N:    notes) for details.
N:    
N:    Severity: error
N:    
N:    Check: debian/changelog
N: 
E: swiftlang: dir-in-usr-local usr/local/include/
N: 
N:    The package installs a directory in /usr/local/... which is not allowed.
N:    
N:    If you want to provide an empty directory in /usr/local for convenience
N:    of the local system administrator, please follow the rules in the policy
N:    manual (section 9.1.2), i.e., create the directories in the postinst
N:    script but don't fail if this isn't possible (e.g. if /usr/local is
N:    mounted read-only).
N:    
N:    Refer to Debian Policy Manual section 9.1.2 (Site-specific programs) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: files/hierarchy-standard
N: 
E: swiftlang: dir-in-usr-local usr/local/include/indexstore/
E: swiftlang: embedded-library usr/bin/sourcekit-lsp: libyaml
N: 
N:    The given ELF object appears to have been statically linked to a
N:    library. Doing this is strongly discouraged due to the extra work needed
N:    by the security team to fix all the extra embedded copies or trigger the
N:    package rebuilds, as appropriate.
N:    
N:    If the package uses a modified version of the given library it is highly
N:    recommended to coordinate with the library's maintainer to include the
N:    changes on the system version of the library.
N:    
N:    Refer to Debian Policy Manual section 4.13 (Convenience copies of code)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: embedded-library usr/bin/swift-build-sdk-interfaces: libyaml
E: swiftlang: embedded-library usr/bin/swift-build: libyaml
E: swiftlang: embedded-library usr/bin/swift-driver: libyaml
E: swiftlang: embedded-library usr/bin/swift-package-collection: libyaml
E: swiftlang: embedded-library usr/bin/swift-package: libyaml
E: swiftlang: embedded-library usr/bin/swift-run: libyaml
E: swiftlang: embedded-library usr/bin/swift-test: libyaml
E: swiftlang: file-in-usr-local usr/local/include/indexstore/IndexStoreCXX.h
N: 
N:    The package installs a file in /usr/local/... which is not allowed.
N:    
N:    Refer to Debian Policy Manual section 9.1.2 (Site-specific programs) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: files/hierarchy-standard
N: 
E: swiftlang: file-in-usr-local usr/local/include/indexstore/indexstore.h
E: swiftlang: manpage-not-compressed usr/share/man/man1/swift.1
N: 
N:    Manual pages have to be installed compressed (using "gzip -9n").
N:    
N:    Refer to Debian Policy Manual section 12.1 (Manual pages) for details.
N:    
N:    Severity: error
N:    
N:    Check: documentation/man
N: 
E: swiftlang: no-copyright-file
N: 
N:    Each binary package has to include a plain file
N:    /usr/share/doc/<pkg>/copyright
N:    
N:    Refer to Debian Policy Manual section 12.5 (Copyright information) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: debian/copyright
N: 
E: swiftlang: no-shlibs-control-file usr/lib/libIndexStore.so.10git
N: 
N:    Although the package includes a shared library, the package does not
N:    have a shlibs control file. If this is intentional, please override this
N:    error.
N:    
N:    Refer to Debian Policy Manual section 8.6 (Dependencies between the
N:    library and other packages) for details.
N:    
N:    Severity: error
N:    
N:    Check: shared-libs
N: 
E: swiftlang: no-shlibs-control-file usr/lib/liblldb.so.10.0.0git
E: swiftlang: package-installs-python-pycache-dir usr/lib/python3/dist-packages/lldb/__pycache__/
N: 
N:    The package installs a __pycache__ directory, which is normally only
N:    used to store compiled Python source files. Compiled Python source files
N:    must not be included in the package, instead they should be generated at
N:    installation time in the postinst.
N:    
N:    Note this tag is issues even if the directory is empty.
N:    
N:    Refer to Debian Python Policy section 3.7 (Modules Byte-Compilation) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: languages/python
N: 
E: swiftlang: package-must-activate-ldconfig-trigger usr/lib/libswiftDemangle.so
N: 
N:    The package installs shared libraries in a directory controlled by the
N:    dynamic library loader. Therefore, the package must trigger libc's
N:    "ldconfig" trigger to ensure the ldconfig cache is updated.
N:    
N:    If the package is using debhelper, dh_makeshlibs should automatically
N:    discover this and add the trigger itself. Otherwise, please add
N:    activate-noawait ldconfig to the triggers file in the control member.
N:    
N:    Note this tag may trigger for packages built with debhelper before
N:    version 9.20151004. In such case, a simple rebuild will often be
N:    sufficient to fix this issue.
N:    
N:    Refer to Debian Policy Manual section 8.1.1 (ldconfig) and
N:    https://lists.debian.org/debian-devel/2015/08/msg00412.html for details.
N:    
N:    Severity: error
N:    
N:    Check: shared-libs
N: 
E: swiftlang: python-script-but-no-python-dep usr/bin/swift-api-checker.py #!python
N: 
N:    Packages with Python scripts should depend on the package python. Those
N:    with scripts that specify a specific version of Python must depend,
N:    recommend or suggest on that version of Python (exactly).
N:    
N:    For example, if a script in the package uses #!/usr/bin/python, the
N:    package needs a dependency on python. If a script uses
N:    #!/usr/bin/python2.6, the package needs a dependency on python2.6. A
N:    dependency on python (>= 2.6) is not correct, since later versions of
N:    Python may not provide the /usr/bin/python2.6 binary.
N:    
N:    If you are using debhelper, adding ${python3:Depends} or
N:    ${python:Depends} to the Depends field and ensuring dh_python2 or
N:    dh_python3 are run during the build should take care of adding the
N:    correct dependency.
N:    
N:    In some cases a weaker relationship, such as Suggests or Recommends,
N:    will be more appropriate.
N:    
N:    Severity: error
N:    
N:    Check: scripts
N: 
E: swiftlang: python-script-but-no-python-dep usr/lib/clang/10.0.0/bin/hwasan_symbolize #!python
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libicudataswift.so.65.1 0755
N: 
N:    Shared libraries should be mode 0644.
N:    
N:    Refer to Debian Policy Manual section 8.1 (Run-time shared libraries)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: shared-libs
N: 
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libicui18nswift.so.65.1 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libicuucswift.so.65.1 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libswiftCore.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libswiftGlibc.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libswiftRemoteMirror.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libswiftSwiftOnoneSupport.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libswift_Concurrency.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/linux/libswift_Differentiation.so 0755
E: swiftlang: subdir-in-usr-bin usr/bin/sdk-module-lists/
N: 
N:    The Filesystem Hierarchy Standard forbids the installation of new
N:    directories in /usr/bin other than /usr/bin/mh.
N:    
N:    Refer to Filesystem Hierarchy Standard (/usr/bin : Most user commands)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: files/hierarchy-standard
N: 
E: swiftlang: unstripped-binary-or-object usr/bin/clang-10
N: 
N:    The package installs an unstripped binary or object file.
N:    
N:    Please note, that shared libraries have to be stripped with the
N:    --strip-unneeded option.
N:    
N:    Refer to Debian Policy Manual section 10.1 (Binaries) and Debian Policy
N:    Manual section 10.2 (Libraries) for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: unstripped-binary-or-object usr/bin/clangd
E: swiftlang: unstripped-binary-or-object usr/bin/lld
E: swiftlang: unstripped-binary-or-object usr/bin/lldb
E: swiftlang: unstripped-binary-or-object usr/bin/lldb-argdumper
E: swiftlang: unstripped-binary-or-object usr/bin/lldb-server
E: swiftlang: unstripped-binary-or-object usr/bin/llvm-cov
E: swiftlang: unstripped-binary-or-object usr/bin/llvm-profdata
E: swiftlang: unstripped-binary-or-object usr/bin/plutil
E: swiftlang: unstripped-binary-or-object usr/bin/repl_swift
E: swiftlang: unstripped-binary-or-object usr/bin/sourcekit-lsp
E: swiftlang: unstripped-binary-or-object usr/bin/swift-build
E: swiftlang: unstripped-binary-or-object usr/bin/swift-build-sdk-interfaces
E: swiftlang: unstripped-binary-or-object usr/bin/swift-build-tool
E: swiftlang: unstripped-binary-or-object usr/bin/swift-demangle
E: swiftlang: unstripped-binary-or-object usr/bin/swift-driver
E: swiftlang: unstripped-binary-or-object usr/bin/swift-frontend
E: swiftlang: unstripped-binary-or-object usr/bin/swift-help
E: swiftlang: unstripped-binary-or-object usr/bin/swift-package
E: swiftlang: unstripped-binary-or-object usr/bin/swift-package-collection
E: swiftlang: unstripped-binary-or-object usr/bin/swift-run
E: swiftlang: unstripped-binary-or-object usr/bin/swift-test
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.asan-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.dyndd-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.hwasan-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.memprof-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.scudo-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.scudo_minimal-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_minimal-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_standalone-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/libIndexStore.so.10git
E: swiftlang: unstripped-binary-or-object usr/lib/liblldb.so.10.0.0git
E: swiftlang: unstripped-binary-or-object usr/lib/libsourcekitdInProc.so
E: swiftlang: unstripped-binary-or-object usr/lib/libswiftDemangle.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libBlocksRuntime.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libFoundation.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libFoundationNetworking.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libFoundationXML.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libXCTest.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/lib_InternalSwiftScan.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/lib_InternalSwiftSyntaxParser.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libdispatch.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libicudataswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libicui18nswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libicuucswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswiftCore.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswiftDispatch.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswiftGlibc.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswiftRemoteMirror.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswiftSwiftOnoneSupport.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswift_Concurrency.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/linux/libswift_Differentiation.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/pm/ManifestAPI/libPackageDescription.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/pm/PluginAPI/libPackagePlugin.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/pm/llbuild/libllbuild.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/pm/llbuild/libllbuildSwift.so
W: swiftlang: binary-without-manpage usr/bin/clang
N: 
N:    Each binary in /usr/bin, /usr/sbin, /bin, /sbin or /usr/games should
N:    have a manual page
N:    
N:    Note that though the man program has the capability to check for several
N:    program names in the NAMES section, each of these programs should have
N:    its own manual page (a symbolic link to the appropriate manual page is
N:    sufficient) because other manual page viewers such as xman or tkman
N:    don't support this.
N:    
N:    If the name of the man page differs from the binary by case, man may be
N:    able to find it anyway; however, it is still best practice to make the
N:    case of the man page match the case of the binary.
N:    
N:    If the man pages are provided by another package on which this package
N:    depends, Lintian may not be able to determine that man pages are
N:    available. In this case, after confirming that all binaries do have man
N:    pages after this package and its dependencies are installed, please add
N:    a Lintian override.
N:    
N:    Refer to Debian Policy Manual section 12.1 (Manual pages) for details.
N:    
N:    Severity: warning
N:    
N:    Check: documentation/man
N: 
W: swiftlang: binary-without-manpage usr/bin/clang++
W: swiftlang: binary-without-manpage usr/bin/clang-10
W: swiftlang: binary-without-manpage usr/bin/clang-cl
W: swiftlang: binary-without-manpage usr/bin/clang-cpp
W: swiftlang: binary-without-manpage usr/bin/clangd
W: swiftlang: binary-without-manpage usr/bin/ld.lld
W: swiftlang: binary-without-manpage usr/bin/ld64.lld
W: swiftlang: binary-without-manpage usr/bin/ld64.lld.darwinnew
W: swiftlang: binary-without-manpage usr/bin/lld
W: swiftlang: binary-without-manpage usr/bin/lld-link
W: swiftlang: binary-without-manpage usr/bin/lldb
W: swiftlang: binary-without-manpage usr/bin/lldb-argdumper
W: swiftlang: binary-without-manpage usr/bin/lldb-server
W: swiftlang: binary-without-manpage usr/bin/llvm-cov
W: swiftlang: binary-without-manpage usr/bin/llvm-profdata
W: swiftlang: binary-without-manpage usr/bin/plutil
W: swiftlang: binary-without-manpage usr/bin/repl_swift
W: swiftlang: binary-without-manpage usr/bin/sourcekit-lsp
W: swiftlang: binary-without-manpage usr/bin/swift-api-checker.py
W: swiftlang: binary-without-manpage usr/bin/swift-api-digester
W: swiftlang: binary-without-manpage usr/bin/swift-api-extract
W: swiftlang: binary-without-manpage usr/bin/swift-autolink-extract
W: swiftlang: binary-without-manpage usr/bin/swift-build
W: swiftlang: binary-without-manpage usr/bin/swift-build-sdk-interfaces
W: swiftlang: binary-without-manpage usr/bin/swift-build-tool
W: swiftlang: binary-without-manpage usr/bin/swift-demangle
W: swiftlang: binary-without-manpage usr/bin/swift-driver
W: swiftlang: binary-without-manpage usr/bin/swift-frontend
W: swiftlang: binary-without-manpage usr/bin/swift-help
W: swiftlang: binary-without-manpage usr/bin/swift-package
W: swiftlang: binary-without-manpage usr/bin/swift-package-collection
W: swiftlang: binary-without-manpage usr/bin/swift-run
W: swiftlang: binary-without-manpage usr/bin/swift-symbolgraph-extract
W: swiftlang: binary-without-manpage usr/bin/swift-test
W: swiftlang: binary-without-manpage usr/bin/swiftc
W: swiftlang: binary-without-manpage usr/bin/wasm-ld
W: swiftlang: description-synopsis-starts-with-article
N: 
N:    The first line of the "Description:" should omit any initial indefinite
N:    or definite article: "a", "an", or "the". A good heuristic is that it
N:    should be possible to substitute the package name and synopsis into this
N:    formula:
N:    
N:    The package name provides {a,an,the,some} synopsis.
N:    
N:    Refer to Debian Developer's Reference section 6.2.2 (The package
N:    synopsis, or short description) for details.
N:    
N:    Severity: warning
N:    
N:    Check: fields/description
N: 
W: swiftlang: executable-not-elf-or-script usr/lib/swift_static/linux/libicudataswift.a
N: 
N:    This executable file is not an ELF format binary, and does not start
N:    with the #! sequence that marks interpreted scripts. It might be a sh
N:    script that fails to name /bin/sh as its shell, or it may be incorrectly
N:    marked as executable. Sometimes upstream files developed on Windows are
N:    marked unnecessarily as executable on other systems.
N:    
N:    If you are using debhelper to build your package, running dh_fixperms
N:    will often correct this problem for you.
N:    
N:    Refer to Debian Policy Manual section 10.4 (Scripts) for details.
N:    
N:    Severity: warning
N:    
N:    Check: scripts
N: 
W: swiftlang: executable-not-elf-or-script usr/lib/swift_static/linux/libicui18nswift.a
W: swiftlang: executable-not-elf-or-script usr/lib/swift_static/linux/libicuucswift.a
W: swiftlang: extended-description-line-too-long
N: 
N:    One or more lines in the extended part of the "Description:" field have
N:    been found to contain more than 80 characters. For the benefit of users
N:    of 80x25 terminals, it is recommended that the lines do not exceed 80
N:    characters.
N:    
N:    Refer to Debian Policy Manual section 3.4.1 (The single line synopsis)
N:    for details.
N:    
N:    Severity: warning
N:    
N:    Check: fields/description
N: 
W: swiftlang: file-in-unusual-dir usr/local/include/indexstore/IndexStoreCXX.h
N: 
N:    This file or symbolic link is in a directory where files are not
N:    normally installed by Debian packages.
N:    
N:    Severity: warning
N:    
N:    Check: files/hierarchy-standard
N: 
W: swiftlang: file-in-unusual-dir usr/local/include/indexstore/indexstore.h
W: swiftlang: hardening-no-pie usr/bin/clang-10
N: 
N:    This package provides an ELF executable that was not compiled as a
N:    position independent executable (PIE).
N:    
N:    In Debian, since version 6.2.0-7 of the gcc-6 package GCC will compile
N:    ELF binaries with PIE by default. In most cases a simple rebuild will be
N:    sufficient to remove this tag.
N:    
N:    PIE is required for fully enabling Address Space Layout Randomization
N:    (ASLR), which makes "Return-oriented" attacks more difficult.
N:    
N:    Historically, PIE has been associated with noticeable performance
N:    overhead on i386. However, GCC >= 5 has implemented an optimization that
N:    can reduce the overhead significantly.
N:    
N:    If you use dpkg-buildflags with hardening=+all,-pie in
N:    DEB_BUILD_MAINT_OPTIONS, remove the -pie.
N:    
N:    Refer to https://wiki.debian.org/Hardening,
N:    https://gcc.gnu.org/gcc-5/changes.html, and
N:    https://software.intel.com/en-us/blogs/2014/12/26/new-optimizations-for-x86-in-upcoming-gcc-50-32bit-pic-mode
N:    for details.
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 
W: swiftlang: hardening-no-pie usr/bin/clangd
W: swiftlang: hardening-no-pie usr/bin/lld
W: swiftlang: hardening-no-pie usr/bin/lldb
W: swiftlang: hardening-no-pie usr/bin/lldb-argdumper
W: swiftlang: hardening-no-pie usr/bin/lldb-server
W: swiftlang: hardening-no-pie usr/bin/llvm-cov
W: swiftlang: hardening-no-pie usr/bin/llvm-profdata
W: swiftlang: hardening-no-pie usr/bin/repl_swift
W: swiftlang: hardening-no-pie usr/bin/swift-build-tool
W: swiftlang: hardening-no-pie usr/bin/swift-demangle
W: swiftlang: hardening-no-pie usr/bin/swift-frontend
W: swiftlang: non-dev-pkg-with-shlib-symlink usr/lib/libIndexStore.so.10git usr/lib/libIndexStore.so
N: 
N:    Although this package is not a "-dev" package, it installs a
N:    "libsomething.so" symbolic link referencing the corresponding shared
N:    library. When the link doesn't include the version number, it is used by
N:    the linker when other programs are built against this shared library.
N:    
N:    Shared libraries are supposed to place such symbolic links in their
N:    respective "-dev" packages, so it is a bug to include it with the main
N:    library package.
N:    
N:    However, if this is a small package which includes the runtime and the
N:    development libraries, this is not a bug. In the latter case, please
N:    override this warning.
N:    
N:    Refer to Debian Policy Manual section 8.4 (Development files) for
N:    details.
N:    
N:    Severity: warning
N:    
N:    Check: shared-libs
N: 
W: swiftlang: non-dev-pkg-with-shlib-symlink usr/lib/liblldb.so.10.0.0git usr/lib/liblldb.so
W: swiftlang: package-name-doesnt-match-sonames libIndexStore10git liblldb10git libsourcekitdInProc libswiftDemangle
N: 
N:    The package name of a library package should usually reflect the soname
N:    of the included library. The package name can determined from the
N:    library file name with the following code snippet:
N:    
N:     $ objdump -p /path/to/libfoo-bar.so.1.2.3 | sed -n -e's/^[[:space:]]*SONAME[[:space:]]*//p' | \
N:         sed -r -e's/([0-9])\.so\./\1-/; s/\.so(\.|$)//; y/_/-/; s/(.*)/\L&/'
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 
W: swiftlang: script-not-executable usr/bin/sdk-module-lists/infer-imports.py
N: 
N:    This file starts with the #! sequence that marks interpreted scripts,
N:    but it is not executable.
N:    
N:    Severity: warning
N:    
N:    Check: scripts
N: 
W: swiftlang: script-with-language-extension usr/bin/swift-api-checker.py
N: 
N:    When scripts are installed into a directory in the system PATH, the
N:    script name should not include an extension such as .sh or .pl that
N:    denotes the scripting language currently used to implement it. The
N:    implementation language may change; if it does, leaving the name the
N:    same would be confusing and changing it would be disruptive.
N:    
N:    Refer to Debian Policy Manual section 10.4 (Scripts) for details.
N:    
N:    Severity: warning
N:    
N:    Check: files/scripts
N: 
W: swiftlang: shared-lib-without-dependency-information usr/lib/swift/linux/libicudataswift.so.65.1
N: 
N:    The listed shared library doesn't include information about which other
N:    libraries the library was linked against. (When running "ldd foo.so" ldd
N:    should report about these other libraries. In your case, ldd just
N:    reports "statically linked".)
N:    
N:    To fix this, you should explicitly specify the libraries which are used
N:    (e.g., "-lc") when building the shared library with "ld".
N:    
N:    If you have questions about this, please contact
N:    debian-devel@lists.debian.org.
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 
W: swiftlang: shlib-without-versioned-soname usr/lib/libsourcekitdInProc.so libsourcekitdInProc.so
N: 
N:    The listed shared library in a public library directory has an SONAME
N:    that does not contain any versioning information, either after the .so
N:    or before it and set off by a hyphen. It cannot therefore be represented
N:    in the shlibs system, and if linked by binaries its interface cannot
N:    safely change. There is no backward-compatible way to migrate programs
N:    linked against it to a new ABI.
N:    
N:    Normally, this means the shared library is a private library for a
N:    particular application and is not meant for general use. Policy
N:    recommends that such libraries be installed in a subdirectory of
N:    /usr/lib rather than in a public shared library directory.
N:    
N:    To view the SONAME of a shared library, run readelf -d on the shared
N:    library and look for the tag of type SONAME.
N:    
N:    There are some special stub libraries or special-purpose shared objects
N:    for which an ABI version is not meaningful. If this is one of those
N:    cases, please add an override.
N:    
N:    Refer to Debian Policy Manual section 10.2 (Libraries) and Debian Policy
N:    Manual section 8.6 (Dependencies between the library and other packages)
N:    for details.
N:    
N:    Severity: warning
N:    
N:    Check: shared-libs
N: 
W: swiftlang: shlib-without-versioned-soname usr/lib/libswiftDemangle.so libswiftDemangle.so
@futurejones
Copy link
Contributor Author

Updated Test Output

I have rebuilt the test package using /usr/lib/ as an install location.

lintian -i -v swiftlang_5.5.1-02-ubuntu-focal_amd64.deb
N: Using profile ubuntu/main.
N: Starting on group swiftlang/5.5.1
N: Unpacking packages in group swiftlang/5.5.1
N: Finished processing group swiftlang/5.5.1
N: ----
N: Processing binary package swiftlang
N: (version 5.5.1, arch amd64) ...
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/bin/lldb /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
N: 
N:    The binary or shared library sets RPATH or RUNPATH. This overrides the
N:    normal library search path, possibly interfering with local policy and
N:    causing problems for multilib, among other issues.
N:    
N:    The only time a binary or shared library in a Debian package should set
N:    RPATH or RUNPATH is if it is linked to private shared libraries in the
N:    same package. In that case, place those private shared libraries in
N:    /usr/lib/<package>. Libraries used by binaries in other packages should
N:    be placed in /lib or /usr/lib as appropriate, with a proper SONAME, in
N:    which case RPATH/RUNPATH is unnecessary.
N:    
N:    To fix this problem, look for link lines like:
N:        gcc test.o -o test -Wl,--rpath,/usr/local/lib
N:    or
N:        gcc test.o -o test -R/usr/local/lib
N:    and remove the -Wl,--rpath or -R argument. You can also use the chrpath
N:    utility to remove the RPATH.
N:    
N:    Refer to https://wiki.debian.org/RpathIssue for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/bin/lldb-argdumper /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/bin/lldb-server /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/bin/plutil /home/build-user/build/buildbot_linux/swift-linux-x86_64/lib/swift/linux
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.memprof-x86_64.so /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_minimal-x86_64.so /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swift/usr/lib/liblldb.so.10.0.0git /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: changelog-file-missing-in-native-package
N: 
N:    Each Debian package (which provides a /usr/share/doc/<pkg> directory)
N:    has to install a changelog file. Since this package seems to be a native
N:    Debian package (i.e., there is no upstream source), the file should
N:    usually be installed as /usr/share/doc/<pkg>/changelog.gz
N:    
N:    Note that Lintian may emit this tag if the changelog exists, but it does
N:    not look like a Debian changelog.
N:    
N:    Refer to Debian Policy Manual section 12.7 (Changelog files and release
N:    notes) for details.
N:    
N:    Severity: error
N:    
N:    Check: debian/changelog
N: 
E: swiftlang: embedded-library usr/lib/swift/usr/bin/sourcekit-lsp: libyaml
N: 
N:    The given ELF object appears to have been statically linked to a
N:    library. Doing this is strongly discouraged due to the extra work needed
N:    by the security team to fix all the extra embedded copies or trigger the
N:    package rebuilds, as appropriate.
N:    
N:    If the package uses a modified version of the given library it is highly
N:    recommended to coordinate with the library's maintainer to include the
N:    changes on the system version of the library.
N:    
N:    Refer to Debian Policy Manual section 4.13 (Convenience copies of code)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-build-sdk-interfaces: libyaml
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-build: libyaml
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-driver: libyaml
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-package-collection: libyaml
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-package: libyaml
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-run: libyaml
E: swiftlang: embedded-library usr/lib/swift/usr/bin/swift-test: libyaml
E: swiftlang: no-copyright-file
N: 
N:    Each binary package has to include a plain file
N:    /usr/share/doc/<pkg>/copyright
N:    
N:    Refer to Debian Policy Manual section 12.5 (Copyright information) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: debian/copyright
N: 
E: swiftlang: package-installs-python-pycache-dir usr/lib/swift/usr/lib/python3/dist-packages/lldb/__pycache__/
N: 
N:    The package installs a __pycache__ directory, which is normally only
N:    used to store compiled Python source files. Compiled Python source files
N:    must not be included in the package, instead they should be generated at
N:    installation time in the postinst.
N:    
N:    Note this tag is issues even if the directory is empty.
N:    
N:    Refer to Debian Python Policy section 3.7 (Modules Byte-Compilation) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: languages/python
N: 
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libicui18nswift.so.65.1 0755
N: 
N:    Shared libraries should be mode 0644.
N:    
N:    Refer to Debian Policy Manual section 8.1 (Run-time shared libraries)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: shared-libs
N: 
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libicuucswift.so.65.1 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libswiftCore.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libswiftGlibc.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libswiftRemoteMirror.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libswiftSwiftOnoneSupport.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libswift_Concurrency.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swift/usr/lib/swift/linux/libswift_Differentiation.so 0755
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/clang-10
N: 
N:    The package installs an unstripped binary or object file.
N:    
N:    Please note, that shared libraries have to be stripped with the
N:    --strip-unneeded option.
N:    
N:    Refer to Debian Policy Manual section 10.1 (Binaries) and Debian Policy
N:    Manual section 10.2 (Libraries) for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/clangd
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/lld
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/lldb
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/lldb-argdumper
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/lldb-server
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/llvm-cov
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/llvm-profdata
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/plutil
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/repl_swift
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/sourcekit-lsp
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-build
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-build-sdk-interfaces
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-build-tool
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-demangle
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-driver
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-frontend
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-help
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-package
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-package-collection
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-run
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/bin/swift-test
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.asan-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.dyndd-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.hwasan-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.memprof-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.scudo-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.scudo_minimal-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_minimal-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_standalone-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/libIndexStore.so.10git
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/liblldb.so.10.0.0git
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/libsourcekitdInProc.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/libswiftDemangle.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libBlocksRuntime.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libFoundation.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libFoundationNetworking.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libFoundationXML.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libXCTest.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/lib_InternalSwiftScan.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/lib_InternalSwiftSyntaxParser.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libdispatch.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libicudataswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libicui18nswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libicuucswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswiftCore.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswiftDispatch.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswiftGlibc.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswiftRemoteMirror.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswiftSwiftOnoneSupport.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswift_Concurrency.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/linux/libswift_Differentiation.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/pm/ManifestAPI/libPackageDescription.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/pm/PluginAPI/libPackagePlugin.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/pm/llbuild/libllbuild.so
E: swiftlang: unstripped-binary-or-object usr/lib/swift/usr/lib/swift/pm/llbuild/libllbuildSwift.so
W: swiftlang: executable-not-elf-or-script usr/lib/swift/usr/lib/swift_static/linux/libicudataswift.a
N: 
N:    This executable file is not an ELF format binary, and does not start
N:    with the #! sequence that marks interpreted scripts. It might be a sh
N:    script that fails to name /bin/sh as its shell, or it may be incorrectly
N:    marked as executable. Sometimes upstream files developed on Windows are
N:    marked unnecessarily as executable on other systems.
N:    
N:    If you are using debhelper to build your package, running dh_fixperms
N:    will often correct this problem for you.
N:    
N:    Refer to Debian Policy Manual section 10.4 (Scripts) for details.
N:    
N:    Severity: warning
N:    
N:    Check: scripts
N: 
W: swiftlang: executable-not-elf-or-script usr/lib/swift/usr/lib/swift_static/linux/libicui18nswift.a
W: swiftlang: executable-not-elf-or-script usr/lib/swift/usr/lib/swift_static/linux/libicuucswift.a
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/clang-10
N: 
N:    This package provides an ELF executable that was not compiled as a
N:    position independent executable (PIE).
N:    
N:    In Debian, since version 6.2.0-7 of the gcc-6 package GCC will compile
N:    ELF binaries with PIE by default. In most cases a simple rebuild will be
N:    sufficient to remove this tag.
N:    
N:    PIE is required for fully enabling Address Space Layout Randomization
N:    (ASLR), which makes "Return-oriented" attacks more difficult.
N:    
N:    Historically, PIE has been associated with noticeable performance
N:    overhead on i386. However, GCC >= 5 has implemented an optimization that
N:    can reduce the overhead significantly.
N:    
N:    If you use dpkg-buildflags with hardening=+all,-pie in
N:    DEB_BUILD_MAINT_OPTIONS, remove the -pie.
N:    
N:    Refer to https://wiki.debian.org/Hardening,
N:    https://gcc.gnu.org/gcc-5/changes.html, and
N:    https://software.intel.com/en-us/blogs/2014/12/26/new-optimizations-for-x86-in-upcoming-gcc-50-32bit-pic-mode
N:    for details.
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/clangd
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/lld
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/lldb
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/lldb-argdumper
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/lldb-server
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/llvm-cov
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/llvm-profdata
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/repl_swift
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/swift-build-tool
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/swift-demangle
W: swiftlang: hardening-no-pie usr/lib/swift/usr/bin/swift-frontend
W: swiftlang: shared-lib-without-dependency-information usr/lib/swift/usr/lib/swift/linux/libicudataswift.so.65.1
N: 
N:    The listed shared library doesn't include information about which other
N:    libraries the library was linked against. (When running "ldd foo.so" ldd
N:    should report about these other libraries. In your case, ldd just
N:    reports "statically linked".)
N:    
N:    To fix this, you should explicitly specify the libraries which are used
N:    (e.g., "-lc") when building the shared library with "ld".
N:    
N:    If you have questions about this, please contact
N:    debian-devel@lists.debian.org.
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 

@drexin
Copy link
Member

drexin commented Jan 24, 2022

If I understand the first error correctly, it should be fixed by installing it into a directory with the name of the package. I.e. /usr/lib/swiftlang instead of /usr/lib/swift

@futurejones
Copy link
Contributor Author

Updated Test Output

@drexin @shahmishal

I have rebuilt the test package using /usr/lib/swiftlang as an install location. There was no change in the rpath error.

It seems strange that we are seeing references to the original build directory here - '/home/build-user/build/buildbot_linux/'

~/deb_package_tests/NEW$ lintian -i -v swiftlang_5.5.1-TEST7-ubuntu-focal_amd64.deb 
N: Using profile ubuntu/main.
N: Starting on group swiftlang/5.5.1-TEST7-ubuntu-focal
N: Unpacking packages in group swiftlang/5.5.1-TEST7-ubuntu-focal
N: Finished processing group swiftlang/5.5.1-TEST7-ubuntu-focal
N: ----
N: Processing binary package swiftlang
N: (version 5.5.1-TEST7-ubuntu-focal, arch amd64) ...
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/bin/lldb /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
N: 
N:    The binary or shared library sets RPATH or RUNPATH. This overrides the
N:    normal library search path, possibly interfering with local policy and
N:    causing problems for multilib, among other issues.
N:    
N:    The only time a binary or shared library in a Debian package should set
N:    RPATH or RUNPATH is if it is linked to private shared libraries in the
N:    same package. In that case, place those private shared libraries in
N:    /usr/lib/<package>. Libraries used by binaries in other packages should
N:    be placed in /lib or /usr/lib as appropriate, with a proper SONAME, in
N:    which case RPATH/RUNPATH is unnecessary.
N:    
N:    To fix this problem, look for link lines like:
N:        gcc test.o -o test -Wl,--rpath,/usr/local/lib
N:    or
N:        gcc test.o -o test -R/usr/local/lib
N:    and remove the -Wl,--rpath or -R argument. You can also use the chrpath
N:    utility to remove the RPATH.
N:    
N:    Refer to https://wiki.debian.org/RpathIssue for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/bin/lldb-argdumper /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/bin/lldb-server /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/bin/plutil /home/build-user/build/buildbot_linux/swift-linux-x86_64/lib/swift/linux
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.memprof-x86_64.so /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_minimal-x86_64.so /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: binary-or-shlib-defines-rpath usr/lib/swiftlang/lib/liblldb.so.10.0.0git /home/build-user/build/buildbot_linux/llvm-linux-x86_64/lib
E: swiftlang: debian-changelog-file-missing-or-wrong-name
N: 
N:    Each Debian package (which provides a /usr/share/doc/<pkg> directory)
N:    must install a Debian changelog file in
N:    /usr/share/doc/<pkg>/changelog.Debian.gz
N:    
N:    A common error is to name the Debian changelog like an upstream
N:    changelog (/usr/share/doc/<pkg>/changelog.gz); therefore, Lintian will
N:    apply further checks to such a file if it exists even after issuing this
N:    error.
N:    
N:    Refer to Debian Policy Manual section 12.7 (Changelog files and release
N:    notes) for details.
N:    
N:    Severity: error
N:    
N:    Check: debian/changelog
N: 
E: swiftlang: embedded-library usr/lib/swiftlang/bin/sourcekit-lsp: libyaml
N: 
N:    The given ELF object appears to have been statically linked to a
N:    library. Doing this is strongly discouraged due to the extra work needed
N:    by the security team to fix all the extra embedded copies or trigger the
N:    package rebuilds, as appropriate.
N:    
N:    If the package uses a modified version of the given library it is highly
N:    recommended to coordinate with the library's maintainer to include the
N:    changes on the system version of the library.
N:    
N:    Refer to Debian Policy Manual section 4.13 (Convenience copies of code)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-build-sdk-interfaces: libyaml
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-build: libyaml
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-driver: libyaml
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-package-collection: libyaml
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-package: libyaml
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-run: libyaml
E: swiftlang: embedded-library usr/lib/swiftlang/bin/swift-test: libyaml
E: swiftlang: extended-description-is-empty
N: 
N:    The extended description (the lines after the first line of the
N:    "Description:" field) is empty.
N:    
N:    Refer to Debian Policy Manual section 3.4 (The description of a package)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: fields/description
N: 
E: swiftlang: no-copyright-file
N: 
N:    Each binary package has to include a plain file
N:    /usr/share/doc/<pkg>/copyright
N:    
N:    Refer to Debian Policy Manual section 12.5 (Copyright information) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: debian/copyright
N: 
E: swiftlang: package-installs-python-pycache-dir usr/lib/swiftlang/lib/python3/dist-packages/lldb/__pycache__/
N: 
N:    The package installs a __pycache__ directory, which is normally only
N:    used to store compiled Python source files. Compiled Python source files
N:    must not be included in the package, instead they should be generated at
N:    installation time in the postinst.
N:    
N:    Note this tag is issues even if the directory is empty.
N:    
N:    Refer to Debian Python Policy section 3.7 (Modules Byte-Compilation) for
N:    details.
N:    
N:    Severity: error
N:    
N:    Check: languages/python
N: 
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libicudataswift.so.65.1 0755
N: 
N:    Shared libraries should be mode 0644.
N:    
N:    Refer to Debian Policy Manual section 8.1 (Run-time shared libraries)
N:    for details.
N:    
N:    Severity: error
N:    
N:    Check: shared-libs
N: 
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libicui18nswift.so.65.1 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libicuucswift.so.65.1 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libswiftCore.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libswiftGlibc.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libswiftRemoteMirror.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libswiftSwiftOnoneSupport.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libswift_Concurrency.so 0755
E: swiftlang: shlib-with-executable-bit usr/lib/swiftlang/lib/swift/linux/libswift_Differentiation.so 0755
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/clang-10
N: 
N:    The package installs an unstripped binary or object file.
N:    
N:    Please note, that shared libraries have to be stripped with the
N:    --strip-unneeded option.
N:    
N:    Refer to Debian Policy Manual section 10.1 (Binaries) and Debian Policy
N:    Manual section 10.2 (Libraries) for details.
N:    
N:    Severity: error
N:    
N:    Check: binaries
N: 
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/clangd
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/lld
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/lldb
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/lldb-argdumper
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/lldb-server
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/llvm-cov
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/llvm-profdata
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/plutil
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/repl_swift
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/sourcekit-lsp
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-build
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-build-sdk-interfaces
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-build-tool
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-demangle
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-driver
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-frontend
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-help
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-package
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-package-collection
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-run
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/bin/swift-test
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.asan-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.dyndd-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.hwasan-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.memprof-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.scudo-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.scudo_minimal-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_minimal-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/clang/10.0.0/lib/linux/libclang_rt.ubsan_standalone-x86_64.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/libIndexStore.so.10git
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/liblldb.so.10.0.0git
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/libsourcekitdInProc.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/libswiftDemangle.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libBlocksRuntime.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libFoundation.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libFoundationNetworking.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libFoundationXML.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libXCTest.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/lib_InternalSwiftScan.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/lib_InternalSwiftSyntaxParser.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libdispatch.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libicudataswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libicui18nswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libicuucswift.so.65.1
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswiftCore.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswiftDispatch.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswiftGlibc.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswiftRemoteMirror.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswiftSwiftOnoneSupport.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswift_Concurrency.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/linux/libswift_Differentiation.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/pm/ManifestAPI/libPackageDescription.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/pm/PluginAPI/libPackagePlugin.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/pm/llbuild/libllbuild.so
E: swiftlang: unstripped-binary-or-object usr/lib/swiftlang/lib/swift/pm/llbuild/libllbuildSwift.so
W: swiftlang: description-synopsis-starts-with-article
N: 
N:    The first line of the "Description:" should omit any initial indefinite
N:    or definite article: "a", "an", or "the". A good heuristic is that it
N:    should be possible to substitute the package name and synopsis into this
N:    formula:
N:    
N:    The package name provides {a,an,the,some} synopsis.
N:    
N:    Refer to Debian Developer's Reference section 6.2.2 (The package
N:    synopsis, or short description) for details.
N:    
N:    Severity: warning
N:    
N:    Check: fields/description
N: 
W: swiftlang: executable-not-elf-or-script usr/lib/swiftlang/lib/swift_static/linux/libicudataswift.a
N: 
N:    This executable file is not an ELF format binary, and does not start
N:    with the #! sequence that marks interpreted scripts. It might be a sh
N:    script that fails to name /bin/sh as its shell, or it may be incorrectly
N:    marked as executable. Sometimes upstream files developed on Windows are
N:    marked unnecessarily as executable on other systems.
N:    
N:    If you are using debhelper to build your package, running dh_fixperms
N:    will often correct this problem for you.
N:    
N:    Refer to Debian Policy Manual section 10.4 (Scripts) for details.
N:    
N:    Severity: warning
N:    
N:    Check: scripts
N: 
W: swiftlang: executable-not-elf-or-script usr/lib/swiftlang/lib/swift_static/linux/libicui18nswift.a
W: swiftlang: executable-not-elf-or-script usr/lib/swiftlang/lib/swift_static/linux/libicuucswift.a
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/clang-10
N: 
N:    This package provides an ELF executable that was not compiled as a
N:    position independent executable (PIE).
N:    
N:    In Debian, since version 6.2.0-7 of the gcc-6 package GCC will compile
N:    ELF binaries with PIE by default. In most cases a simple rebuild will be
N:    sufficient to remove this tag.
N:    
N:    PIE is required for fully enabling Address Space Layout Randomization
N:    (ASLR), which makes "Return-oriented" attacks more difficult.
N:    
N:    Historically, PIE has been associated with noticeable performance
N:    overhead on i386. However, GCC >= 5 has implemented an optimization that
N:    can reduce the overhead significantly.
N:    
N:    If you use dpkg-buildflags with hardening=+all,-pie in
N:    DEB_BUILD_MAINT_OPTIONS, remove the -pie.
N:    
N:    Refer to https://wiki.debian.org/Hardening,
N:    https://gcc.gnu.org/gcc-5/changes.html, and
N:    https://software.intel.com/en-us/blogs/2014/12/26/new-optimizations-for-x86-in-upcoming-gcc-50-32bit-pic-mode
N:    for details.
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/clangd
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/lld
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/lldb
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/lldb-argdumper
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/lldb-server
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/llvm-cov
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/llvm-profdata
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/repl_swift
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/swift-build-tool
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/swift-demangle
W: swiftlang: hardening-no-pie usr/lib/swiftlang/bin/swift-frontend
W: swiftlang: package-contains-timestamped-gzip usr/share/doc/swiftlang/changelog.gz 2022-01-25T00:29:03
N: 
N:    The package contains a gzip-compressed file that has timestamps. Such
N:    files make the packages unreproducible, because their contents depend on
N:    the time when the package was built.
N:    
N:    Please consider passing the "-n" flag to gzip to avoid this.
N:    
N:    Refer to https://wiki.debian.org/ReproducibleBuilds for details.
N:    
N:    Severity: warning
N:    
N:    Check: files/compressed/gz
N: 
W: swiftlang: shared-lib-without-dependency-information usr/lib/swiftlang/lib/swift/linux/libicudataswift.so.65.1
N: 
N:    The listed shared library doesn't include information about which other
N:    libraries the library was linked against. (When running "ldd foo.so" ldd
N:    should report about these other libraries. In your case, ldd just
N:    reports "statically linked".)
N:    
N:    To fix this, you should explicitly specify the libraries which are used
N:    (e.g., "-lc") when building the shared library with "ld".
N:    
N:    If you have questions about this, please contact
N:    debian-devel@lists.debian.org.
N:    
N:    Severity: warning
N:    
N:    Check: binaries
N: 

@swift-ci swift-ci transferred this issue from apple/swift-issues Apr 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug A deviation from expected or documented behavior. Also: expected but undesirable behavior.
Projects
None yet
Development

No branches or pull requests

2 participants