pkg/57902: inappropriate download behavior of devel/pango

[dholland%NetBSD.org@localhost]

>Number:         57902
>Category:       pkg
>Synopsis:       inappropriate download behavior of devel/pango
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Feb 03 20:25:00 +0000 2024
>Originator:     David A. Holland
>Release:        NetBSD 8.1_STABLE, pkgsrc 20240128
>Organization:
>Environment:
System: NetBSD 8.1_STABLE
Architecture: x86_64
Machine: amd64
>Description:

pango decided it was going to git clone stuff off the internet during
build, which is inappropriate.

Build log fragment:

      :
   WARNING: Found CMake '/usr/pkgsrc/devel/pango/work/.tools/bin/false' but couldn't run it
   Found CMake: NO
   Run-time dependency cairo found: NO (tried pkgconfig and cmake)
   Run-time dependency cairo found: NO (tried pkgconfig and cmake)
   Looking for a fallback subproject for the dependency cairo
   Cloning into 'cairo'...
   remote: Enumerating objects: 3488, done.
      :

(it then failed, because the python script it blithely ran from the
downloaded material had a nonexistent interpreter in it)

This was on -8 and the failure to find cairo is some kind of pixman
issue, but that's not the point. The fallback behavior for such
situations should not be to download and run random stuff off the
internet.

>How-To-Repeat:

corrupt cairo's pkgconfig file, then build pango

>Fix:

I'm not sure if this is a misfeature of meson (in which case it should
be disabled for everything somehow in devel/meson/build.mk) or if it's
a special misfeature of pango (in which case it should be patched out)
but it shouldn't stand.

Dunno in detail though.