Skip to content

[RPM] RPATH sanitization logic is too restrictive (fails for builds outside '/home') #309

@eximius313

Description

@eximius313

Bug Description
The RPM packager attempts to sanitize the RPATH of Flutter plugin shared libraries (lib*_plugin.so) to remove local build paths and replace them with $ORIGIN.

However, the current implementation has a hardcoded check that prevents this logic from running unless the build path contains the string /home.

Source Code Reference:
In packages/flutter_app_packager/lib/src/makers/rpm/app_package_maker_rpm.dart:

// Current implementation:
if (processResult.stdout.toString().contains('/home')) {
  await $('patchelf', ['--set-rpath', '\$ORIGIN', file.path]);
}

Impact
If a developer builds the application in a directory outside of /home (e.g., /mnt/project in WSL, /root in Docker containers, or custom CI workspace paths), the patchelf command is skipped.

As a result, the final RPM package contains shared libraries with private build paths embedded in their RPATH. This is a privacy leak (exposing username/directory structure) and can lead to linting errors in package repositories, even if the app runs correctly due to the main binary's RPATH handling.

Proposed Solution
Relax the condition to check for any absolute path, rather than specifically /home.

final rpath = processResult.stdout.toString().trim();
// Fix RPATH if it is an absolute path (starts with /) and not yet fixed ($ORIGIN)
if (rpath.startsWith('/') && !rpath.contains('\$ORIGIN')) {
  await $('patchelf', ['--set-rpath', '\$ORIGIN', file.path]);
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions