pkg/34816: pkgtools/pkg_chk-1.82 uses /tmp unconditionally for scratch

[jbernard%mines.edu@localhost]

>Number:         34816
>Category:       pkg
>Synopsis:       pkgtools/pkg_chk-1.82 uses /tmp unconditionally for scratch
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 14 19:20:02 +0000 2006
>Originator:     Jim Bernard
>Release:        NetBSD 4.99.2
>Organization:
>Environment:
System: NetBSD 4.99.2 #0: Sat Sep 16 12:17:30 MDT 2006 i386
Architecture: i386
Machine: i386
>Description:
        The pkg_chk shell script unconditionally puts its scratch
        directory under /tmp and sets TMPDIR to the directory created.
        This can lead to filling of the file system containing /tmp
        when installing large package trees, and externally setting
        TMPDIR doesn't help.

        While I'm here: I noticed that pkg_chk executes pkg_add,
        pkg_delete, and pkg_info as arguments to /usr/bin/env, but
        /usr/bin/env is given no flags, nor any environment variables
        to set, and the programs are specified by full path names,
        such as "/usr/bin/env  /usr/sbin/pkg_add ...".  That would seem
        to make the use of /usr/bin/env superfluous.  Perhaps the intent
        was to execute the version of (e.g.) pkg_add in the location where
        the shell would find it in $PATH.  If so, then it's appropriate
        to use just (e.g.) "/usr/bin/env pkg_add ..." without the path
        prefix to pkg_add.

>How-To-Repeat:
        Run pkg_chk with TMPDIR set to, say, /var/tmp, and notice that
        the temporary directory it creates is in /tmp.  Or just read
        the script.

>Fix:
        Here's a candidate patch.

--- /usr/pkg/sbin/pkg_chk       2006-10-14 09:57:23.000000000 -0600
+++ ./pkg_chk   2006-10-14 12:50:20.000000000 -0600
@@ -86,12 +86,12 @@
     done
     }
 
 cleanup_and_exit()
     {
-    rm -f $TMPFILE
-    rmdir $TMPDIR
+    rm -f $PKG_CHK_TMPFILE
+    rmdir $PKG_TMPDIR
     exit "$@"
     }
 
 delete_pkgs()
     {
@@ -246,13 +246,13 @@
        ${PKG_INFO} -. -q -b $PACKAGES/$PKGNAME$PKG_SUFX | ${GREP} .
        return
     fi
     # Unfortunately pkgsrc always outputs to a file, but it does helpfully
     # allows # us to specify the name
-    rm -f $TMPFILE
-    ${MAKE} _BUILD_VERSION_FILE=$TMPFILE $TMPFILE
-    cat $TMPFILE
+    rm -f $PKG_CHK_TMPFILE
+    ${MAKE} _BUILD_VERSION_FILE=$PKG_CHK_TMPFILE $PKG_CHK_TMPFILE
+    cat $PKG_CHK_TMPFILE
     }
 
 list_packages()
     {
     # DEPCHECKLIST contains packages for which binary packages are known to
@@ -666,12 +666,12 @@
 
 if [ $# != 0 ];then
     usage "Additional argument ($*) given"
 fi
 
-TMPDIR=`mktemp -d /tmp/${0##*/}.XXXXXX`
-TMPFILE=$TMPDIR/tmp
+export PKG_TMPDIR=`mktemp -d ${PKG_TMPDIR:-${TMPDIR:-/tmp}}/${0##*/}.XXXXXX`
+PKG_CHK_TMPFILE=$PKG_TMPDIR/tmp
 
 # Hide PKG_PATH to avoid breakage in 'make' calls
 saved_PKG_PATH=$PKG_PATH
 unset PKG_PATH || true