CVS commit: pkgsrc/bootstrap

["Jonathan Perkin" <jperkin%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   jperkin
Date:           Mon Jul  6 10:43:47 UTC 2020

Modified Files:
        pkgsrc/bootstrap: bootstrap

Log Message:
boostrap: Enable mksh by default on macOS 10.11+.

El Capitan (10.11) introduced System Integrity Protection (SIP), and one of
the side effects of this protection is that system shells (i.e. /bin/*sh)
unset any variables that may affect the security of the system.  This causes
problems with packages that rely on e.g. LD_LIBRARY_PATH.

Using a shell outside of the system paths allows us to work around this, at
least for now.

Tested in bulk builds on macOS Catalina, though with SIP disabled (as there
is no way to run sandboxed builds with SIP enabled).


To generate a diff of this commit:
cvs rdiff -u -r1.285 -r1.286 pkgsrc/bootstrap/bootstrap

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/bootstrap/bootstrap
diff -u pkgsrc/bootstrap/bootstrap:1.285 pkgsrc/bootstrap/bootstrap:1.286
--- pkgsrc/bootstrap/bootstrap:1.285    Mon Jul  6 10:25:29 2020
+++ pkgsrc/bootstrap/bootstrap  Mon Jul  6 10:43:47 2020
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-# $NetBSD: bootstrap,v 1.285 2020/07/06 10:25:29 jperkin Exp $
+# $NetBSD: bootstrap,v 1.286 2020/07/06 10:43:47 jperkin Exp $
 #
 # Copyright (c) 2001-2011 Alistair Crooks <agc%NetBSD.org@localhost>
 # All rights reserved.
@@ -589,6 +589,15 @@ Darwin)
                need_sed=yes
        fi
 
+       # Avoid system shells on macOS versions that enable System Integrity
+       # Protection (SIP) as it affects packages that rely on variables such
+       # as LD_LIBRARY_PATH.  SIP unsets any variables that may affect
+       # security when using system binaries, i.e. /bin/*sh, but using a
+       # non-system shell is unaffected, at least for now.
+       if [ $macos_version -ge 1011 ]; then
+               need_mksh=yes
+       fi
+
        case "$macos_version" in
        100[7-9])
                packagemaker=/Applications/PackageMaker.app/Contents/MacOS/PackageMaker