xdg-app build - clean the environment

For builds, reproducability and not accidentally getting
the host environment details into the build is pretty important,
so we rebuild the entire environment, controlling exactly
what gets into it.

xdg-app-builtins-build.c

@@ -48,6 +48,7 @@ xdg_app_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
   gs_free_error GError *my_error = NULL;
   gs_free_error GError *my_error2 = NULL;
   gs_unref_ptrarray GPtrArray *argv_array = NULL;
+  gs_unref_ptrarray GPtrArray *env_array = NULL;
   gsize metadata_size;
   const char *directory = NULL;
   const char *command = "/bin/sh";
@@ -139,19 +140,11 @@ xdg_app_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
 
   g_ptr_array_add (argv_array, NULL);
 
-  g_unsetenv ("ACLOCAL_FLAGS");
-  g_setenv ("ACLOCAL_PATH", "/self/share/aclocal", TRUE);
-  g_setenv ("C_INCLUDE_PATH", "/self/include", TRUE);
-  g_setenv ("CPLUS_INCLUDE_PATH", "/self/include", TRUE);
-  g_setenv ("GI_TYPELIB_PATH", "/self/lib/girepository-1.0", TRUE);
-  g_setenv ("LDFLAGS", "-L/self/lib ", TRUE);
-  g_setenv ("PKG_CONFIG_PATH", "/self/lib/pkgconfig:/self/share/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig", TRUE);
+  env_array = g_ptr_array_new_with_free_func (g_free);
+  xdg_app_run_setup_minimal_env (env_array, TRUE);
+  g_ptr_array_add (env_array, NULL);
 
-  g_setenv ("XDG_DATA_DIRS", "/self/share:/usr/share", TRUE);
-  g_unsetenv ("LD_LIBRARY_PATH");
-  g_setenv ("PATH", "/self/bin:/usr/bin", TRUE);
-
-  if (!execv (HELPER, (char **)argv_array->pdata))
+  if (!execve (HELPER, (char **)argv_array->pdata, (char **)env_array->pdata))
     {
       g_set_error (error, G_IO_ERROR, g_io_error_from_errno (errno), "Unable to start app");
       goto out;

xdg-app-run.c

@@ -92,12 +92,6 @@ xdg_app_run_add_wayland_args (GPtrArray *argv_array)
     g_free (wayland_socket);
 }
 
-void
-xdg_app_run_add_no_x11_args (GPtrArray *argv_array)
-{
-  g_unsetenv ("DISPLAY");
-}
-
 void
 xdg_app_run_add_pulseaudio_args (GPtrArray *argv_array)
 {
@@ -191,10 +185,6 @@ xdg_app_run_add_environment_args (GPtrArray *argv_array,
       g_debug ("Allowing x11 access");
       xdg_app_run_add_x11_args (argv_array);
     }
-  else
-    {
-      xdg_app_run_add_no_x11_args (argv_array);
-    }
 
   if ((g_key_file_get_boolean (metakey, "Environment", "wayland", NULL) || g_strv_contains (allow, "wayland")) &&
       !g_strv_contains (forbid, "wayland"))
@@ -224,3 +214,81 @@ xdg_app_run_add_environment_args (GPtrArray *argv_array,
       xdg_app_run_add_session_dbus_args (argv_array);
     }
 }
+
+void
+xdg_app_run_setup_minimal_env (GPtrArray *env_array,
+			       gboolean devel)
+{
+  static const char const *exports[] = {
+    "XDG_DATA_DIRS=/self/share:/usr/share",
+    "PATH=/self/bin:/usr/bin",
+    "SHELL=/bin/sh",
+  };
+  static const char const *exports_devel[] = {
+    "ACLOCAL_PATH=/self/share/aclocal",
+    "C_INCLUDE_PATH=/self/include",
+    "CPLUS_INCLUDE_PATH=/self/include",
+    "GI_TYPELIB_PATH=/self/lib/girepository-1.0",
+    "LDFLAGS=-L/self/lib ",
+    "PKG_CONFIG_PATH=/self/lib/pkgconfig:/self/share/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig",
+    "LC_ALL=en_US.utf8",
+  };
+  static const char const *copy[] = {
+    "GDMSESSION",
+    "XDG_CURRENT_DESKTOP",
+    "XDG_SESSION_DESKTOP",
+    "DESKTOP_SESSION",
+    "EMAIL_ADDRESS",
+    "HOME",
+    "HOSTNAME",
+    "LOGNAME",
+    "REAL_NAME",
+    "TERM",
+    "USER",
+    "USERNAME",
+  };
+  static const char const *copy_nodevel[] = {
+    "LANG",
+    "LANGUAGE",
+    "LC_ALL",
+    "LC_ADDRESS",
+    "LC_COLLATE",
+    "LC_CTYPE",
+    "LC_IDENTIFICATION",
+    "LC_MEASUREMENT",
+    "LC_MESSAGES",
+    "LC_MONETARY",
+    "LC_NAME",
+    "LC_NUMERIC",
+    "LC_PAPER",
+    "LC_TELEPHONE",
+    "LC_TIME",
+  };
+  int i;
+
+  for (i = 0; i < G_N_ELEMENTS(exports); i++)
+    g_ptr_array_add (env_array, g_strdup (exports[i]));
+
+  if (devel)
+    {
+      for (i = 0; i < G_N_ELEMENTS(exports_devel); i++)
+	g_ptr_array_add (env_array, g_strdup (exports_devel[i]));
+    }
+
+  for (i = 0; i < G_N_ELEMENTS(copy); i++)
+    {
+      const char *current = g_getenv(copy[i]);
+      if (current)
+	g_ptr_array_add (env_array, g_strdup_printf ("%s=%s", copy[i], current));
+    }
+
+  if (!devel)
+    {
+      for (i = 0; i < G_N_ELEMENTS(copy_nodevel); i++)
+	{
+	  const char *current = g_getenv(copy_nodevel[i]);
+	  if (current)
+	    g_ptr_array_add (env_array, g_strdup_printf ("%s=%s", copy_nodevel[i], current));
+	}
+    }
+}

xdg-app-run.h

@@ -7,6 +7,8 @@ void     xdg_app_run_add_environment_args    (GPtrArray   *argv_array,
 					      GKeyFile    *metakey,
 					      const char **allow,
 					      const char **forbid);
+void     xdg_app_run_setup_minimal_env       (GPtrArray   *env_array,
+					      gboolean     devel);
 
 void xdg_app_run_add_x11_args          (GPtrArray *argv_array);
 void xdg_app_run_add_no_x11_args       (GPtrArray *argv_array);