view contrib/packaging/build-linux-wheels.sh @ 41457:6c10eba6b9cd stable

subrepo: prohibit variable expansion on creation of hg subrepo (SEC)

It's probably wrong to expand path at localrepo.*repository() layer, but
fixing the layering issue would require careful inspection of call paths.
So, this patch adds add a validation to the subrepo constructor.

os.path.realpath(util.expandpath(root)) is what vfsmod.vfs() would do.

#!/bin/bash
# This file is directly inspired by
# https://github.com/pypa/python-manylinux-demo/blob/master/travis/build-wheels.sh
set -e -x

PYTHON_TARGETS=$(ls -d /opt/python/cp27*/bin)

# Create an user for the tests
useradd hgbuilder

# Bypass uid/gid problems
cp -R /src /io && chown -R hgbuilder:hgbuilder /io

# Compile wheels for Python 2.X
for PYBIN in $PYTHON_TARGETS; do
    "${PYBIN}/pip" wheel /io/ -w wheelhouse/
done

# Bundle external shared libraries into the wheels with
# auditwheel (https://github.com/pypa/auditwheel) repair.
# It also fix the ABI tag on the wheel making it pip installable.
for whl in wheelhouse/*.whl; do
    auditwheel repair "$whl" -w /src/wheelhouse/
done

# Install packages and run the tests for all Python versions
cd /io/tests/

for PYBIN in $PYTHON_TARGETS; do
    # Install mercurial wheel as root
    "${PYBIN}/pip" install mercurial --no-index -f /src/wheelhouse
    # But run tests as hgbuilder user (non-root)
    su hgbuilder -c "\"${PYBIN}/python\" /io/tests/run-tests.py --with-hg=\"${PYBIN}/hg\" --blacklist=/io/contrib/packaging/linux-wheel-centos5-blacklist"
done