dev-libs/glib: backport GDBus fixes necessary for ibus security fixes
authorMart Raudsepp <leio@gentoo.org>
Wed, 1 Jan 2020 15:40:23 +0000 (17:40 +0200)
committerMart Raudsepp <leio@gentoo.org>
Wed, 1 Jan 2020 15:40:41 +0000 (17:40 +0200)
Closes: https://bugs.gentoo.org/700538
Package-Manager: Portage-2.3.79, Repoman-2.3.12
Signed-off-by: Mart Raudsepp <leio@gentoo.org>
dev-libs/glib/files/2.60.7-gdbus-fixes.patch [new file with mode: 0644]
dev-libs/glib/glib-2.60.7-r1.ebuild [new file with mode: 0644]

diff --git a/dev-libs/glib/files/2.60.7-gdbus-fixes.patch b/dev-libs/glib/files/2.60.7-gdbus-fixes.patch
new file mode 100644 (file)
index 0000000..e2a066b
--- /dev/null
@@ -0,0 +1,301 @@
+From 1cfab12a28d97716ad581c30fbbf3e94e4d7f303 Mon Sep 17 00:00:00 2001
+From: Simon McVittie <smcv@collabora.com>
+Date: Mon, 14 Oct 2019 08:22:24 +0100
+Subject: [PATCH 1/3] gcredentialsprivate: Document the various private macros
+
+Signed-off-by: Simon McVittie <smcv@collabora.com>
+---
+ gio/gcredentialsprivate.h | 59 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 59 insertions(+)
+
+diff --git a/gio/gcredentialsprivate.h b/gio/gcredentialsprivate.h
+index 4d1c420a8..06f0aed19 100644
+--- a/gio/gcredentialsprivate.h
++++ b/gio/gcredentialsprivate.h
+@@ -22,6 +22,65 @@
+ #include "gio/gcredentials.h"
+ #include "gio/gnetworking.h"
++/*
++ * G_CREDENTIALS_SUPPORTED:
++ *
++ * Defined to 1 if GCredentials works.
++ */
++#undef G_CREDENTIALS_SUPPORTED
++
++/*
++ * G_CREDENTIALS_USE_LINUX_UCRED, etc.:
++ *
++ * Defined to 1 if GCredentials uses Linux `struct ucred`, etc.
++ */
++#undef G_CREDENTIALS_USE_LINUX_UCRED
++#undef G_CREDENTIALS_USE_FREEBSD_CMSGCRED
++#undef G_CREDENTIALS_USE_NETBSD_UNPCBID
++#undef G_CREDENTIALS_USE_OPENBSD_SOCKPEERCRED
++#undef G_CREDENTIALS_USE_SOLARIS_UCRED
++
++/*
++ * G_CREDENTIALS_NATIVE_TYPE:
++ *
++ * Defined to one of G_CREDENTIALS_TYPE_LINUX_UCRED, etc.
++ */
++#undef G_CREDENTIALS_NATIVE_TYPE
++
++/*
++ * G_CREDENTIALS_NATIVE_SIZE:
++ *
++ * Defined to the size of the %G_CREDENTIALS_NATIVE_TYPE
++ */
++#undef G_CREDENTIALS_NATIVE_SIZE
++
++/*
++ * G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED:
++ *
++ * Defined to 1 if we have a message-passing API in which credentials
++ * are attached to a particular message, such as `SCM_CREDENTIALS` on Linux
++ * or `SCM_CREDS` on FreeBSD.
++ */
++#undef G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED
++
++/*
++ * G_CREDENTIALS_SOCKET_GET_CREDENTIALS_SUPPORTED:
++ *
++ * Defined to 1 if we have a `getsockopt()`-style API in which one end of
++ * a socket connection can directly query the credentials of the process
++ * that initiated the other end, such as `getsockopt SO_PEERCRED` on Linux
++ * or `getpeereid()` on multiple operating systems.
++ */
++#undef G_CREDENTIALS_SOCKET_GET_CREDENTIALS_SUPPORTED
++
++/*
++ * G_CREDENTIALS_SPOOFING_SUPPORTED:
++ *
++ * Defined to 1 if privileged processes can spoof their credentials when
++ * using the message-passing API.
++ */
++#undef G_CREDENTIALS_SPOOFING_SUPPORTED
++
+ #ifdef __linux__
+ #define G_CREDENTIALS_SUPPORTED 1
+ #define G_CREDENTIALS_USE_LINUX_UCRED 1
+-- 
+2.20.1
+
+
+From 5f9318af8f19756685c1b79cf8b76f3e66614d84 Mon Sep 17 00:00:00 2001
+From: Simon McVittie <smcv@collabora.com>
+Date: Fri, 18 Oct 2019 10:55:09 +0100
+Subject: [PATCH 2/3] credentials: Invalid Linux struct ucred means "no
+ information"
+
+On Linux, if getsockopt SO_PEERCRED is used on a TCP socket, one
+might expect it to fail with an appropriate error like ENOTSUP or
+EPROTONOSUPPORT. However, it appears that in fact it succeeds, but
+yields a credentials structure with pid 0, uid -1 and gid -1. These
+are not real process, user and group IDs that can be allocated to a
+real process (pid 0 needs to be reserved to give kill(0) its documented
+special semantics, and similarly uid and gid -1 need to be reserved for
+setresuid() and setresgid()) so it is not meaningful to signal them to
+high-level API users.
+
+An API user with Linux-specific knowledge can still inspect these fields
+via g_credentials_get_native() if desired.
+
+Similarly, if SO_PASSCRED is used to receive a SCM_CREDENTIALS message
+on a receiving Unix socket, but the sending socket had not enabled
+SO_PASSCRED at the time that the message was sent, it is possible
+for it to succeed but yield a credentials structure with pid 0, uid
+/proc/sys/kernel/overflowuid and gid /proc/sys/kernel/overflowgid. Even
+if we were to read those pseudo-files, we cannot distinguish between
+the overflow IDs and a real process that legitimately has the same IDs
+(typically they are set to 'nobody' and 'nogroup', which can be used
+by a real process), so we detect this situation by noticing that
+pid == 0, and to save syscalls we do not read the overflow IDs from
+/proc at all.
+
+This results in a small API change: g_credentials_is_same_user() now
+returns FALSE if we compare two credentials structures that are both
+invalid. This seems like reasonable, conservative behaviour: if we cannot
+prove that they are the same user, we should assume they are not.
+
+(Dropped new translatable string when backporting to `glib-2-62`.)
+
+Signed-off-by: Simon McVittie <smcv@collabora.com>
+---
+ gio/gcredentials.c | 42 +++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/gio/gcredentials.c b/gio/gcredentials.c
+index 57a39f2a2..ff9b7e0b8 100644
+--- a/gio/gcredentials.c
++++ b/gio/gcredentials.c
+@@ -265,6 +265,35 @@ g_credentials_to_string (GCredentials *credentials)
+ /* ---------------------------------------------------------------------------------------------------- */
++#if G_CREDENTIALS_USE_LINUX_UCRED
++/*
++ * Check whether @native contains invalid data. If getsockopt SO_PEERCRED
++ * is used on a TCP socket, it succeeds but yields a credentials structure
++ * with pid 0, uid -1 and gid -1. Similarly, if SO_PASSCRED is used on a
++ * receiving Unix socket when the sending socket did not also enable
++ * SO_PASSCRED, it can succeed but yield a credentials structure with
++ * pid 0, uid /proc/sys/kernel/overflowuid and gid
++ * /proc/sys/kernel/overflowgid.
++ */
++static gboolean
++linux_ucred_check_valid (struct ucred  *native,
++                         GError       **error)
++{
++  if (native->pid == 0
++      || native->uid == -1
++      || native->gid == -1)
++    {
++      g_set_error_literal (error,
++                           G_IO_ERROR,
++                           G_IO_ERROR_INVALID_DATA,
++                           "GCredentials contains invalid data");
++      return FALSE;
++    }
++
++  return TRUE;
++}
++#endif
++
+ /**
+  * g_credentials_is_same_user:
+  * @credentials: A #GCredentials.
+@@ -294,7 +323,8 @@ g_credentials_is_same_user (GCredentials  *credentials,
+   ret = FALSE;
+ #if G_CREDENTIALS_USE_LINUX_UCRED
+-  if (credentials->native.uid == other_credentials->native.uid)
++  if (linux_ucred_check_valid (&credentials->native, NULL)
++      && credentials->native.uid == other_credentials->native.uid)
+     ret = TRUE;
+ #elif G_CREDENTIALS_USE_FREEBSD_CMSGCRED
+   if (credentials->native.cmcred_euid == other_credentials->native.cmcred_euid)
+@@ -453,7 +483,10 @@ g_credentials_get_unix_user (GCredentials    *credentials,
+   g_return_val_if_fail (error == NULL || *error == NULL, -1);
+ #if G_CREDENTIALS_USE_LINUX_UCRED
+-  ret = credentials->native.uid;
++  if (linux_ucred_check_valid (&credentials->native, error))
++    ret = credentials->native.uid;
++  else
++    ret = -1;
+ #elif G_CREDENTIALS_USE_FREEBSD_CMSGCRED
+   ret = credentials->native.cmcred_euid;
+ #elif G_CREDENTIALS_USE_NETBSD_UNPCBID
+@@ -499,7 +532,10 @@ g_credentials_get_unix_pid (GCredentials    *credentials,
+   g_return_val_if_fail (error == NULL || *error == NULL, -1);
+ #if G_CREDENTIALS_USE_LINUX_UCRED
+-  ret = credentials->native.pid;
++  if (linux_ucred_check_valid (&credentials->native, error))
++    ret = credentials->native.pid;
++  else
++    ret = -1;
+ #elif G_CREDENTIALS_USE_FREEBSD_CMSGCRED
+   ret = credentials->native.cmcred_pid;
+ #elif G_CREDENTIALS_USE_NETBSD_UNPCBID
+-- 
+2.20.1
+
+
+From c7618cce3752e1f3681f75d0a26c7e07c15bd6a2 Mon Sep 17 00:00:00 2001
+From: Simon McVittie <smcv@collabora.com>
+Date: Mon, 14 Oct 2019 08:47:39 +0100
+Subject: [PATCH 3/3] GDBus: prefer getsockopt()-style credentials-passing APIs
+
+Closes: https://gitlab.gnome.org/GNOME/glib/issues/1831
+---
+ gio/gcredentialsprivate.h | 18 ++++++++++++++++++
+ gio/gdbusauth.c           | 27 +++++++++++++++++++++++++--
+ 2 files changed, 43 insertions(+), 2 deletions(-)
+
+diff --git a/gio/gcredentialsprivate.h b/gio/gcredentialsprivate.h
+index 06f0aed19..e9ec09b9f 100644
+--- a/gio/gcredentialsprivate.h
++++ b/gio/gcredentialsprivate.h
+@@ -81,6 +81,18 @@
+  */
+ #undef G_CREDENTIALS_SPOOFING_SUPPORTED
++/*
++ * G_CREDENTIALS_PREFER_MESSAGE_PASSING:
++ *
++ * Defined to 1 if the data structure transferred by the message-passing
++ * API is strictly more informative than the one transferred by the
++ * `getsockopt()`-style API, and hence should be preferred, even for
++ * protocols like D-Bus that are defined in terms of the credentials of
++ * the (process that opened the) socket, as opposed to the credentials
++ * of an individual message.
++ */
++#undef G_CREDENTIALS_PREFER_MESSAGE_PASSING
++
+ #ifdef __linux__
+ #define G_CREDENTIALS_SUPPORTED 1
+ #define G_CREDENTIALS_USE_LINUX_UCRED 1
+@@ -100,6 +112,12 @@
+ #define G_CREDENTIALS_NATIVE_SIZE (sizeof (struct cmsgcred))
+ #define G_CREDENTIALS_UNIX_CREDENTIALS_MESSAGE_SUPPORTED 1
+ #define G_CREDENTIALS_SPOOFING_SUPPORTED 1
++/* GLib doesn't implement it yet, but FreeBSD's getsockopt()-style API
++ * is getpeereid(), which is not as informative as struct cmsgcred -
++ * it does not tell us the PID. As a result, libdbus prefers to use
++ * SCM_CREDS, and if we implement getpeereid() in future, we should
++ * do the same. */
++#define G_CREDENTIALS_PREFER_MESSAGE_PASSING 1
+ #elif defined(__NetBSD__)
+ #define G_CREDENTIALS_SUPPORTED 1
+diff --git a/gio/gdbusauth.c b/gio/gdbusauth.c
+index 752ec23fc..14cc5d70e 100644
+--- a/gio/gdbusauth.c
++++ b/gio/gdbusauth.c
+@@ -31,6 +31,7 @@
+ #include "gdbusutils.h"
+ #include "gioenumtypes.h"
+ #include "gcredentials.h"
++#include "gcredentialsprivate.h"
+ #include "gdbusprivate.h"
+ #include "giostream.h"
+ #include "gdatainputstream.h"
+@@ -969,9 +970,31 @@ _g_dbus_auth_run_server (GDBusAuth              *auth,
+   g_data_input_stream_set_newline_type (dis, G_DATA_STREAM_NEWLINE_TYPE_CR_LF);
+-  /* first read the NUL-byte */
++  /* read the NUL-byte, possibly with credentials attached */
+ #ifdef G_OS_UNIX
+-  if (G_IS_UNIX_CONNECTION (auth->priv->stream))
++#ifndef G_CREDENTIALS_PREFER_MESSAGE_PASSING
++  if (G_IS_SOCKET_CONNECTION (auth->priv->stream))
++    {
++      GSocket *sock = g_socket_connection_get_socket (G_SOCKET_CONNECTION (auth->priv->stream));
++
++      local_error = NULL;
++      credentials = g_socket_get_credentials (sock, &local_error);
++
++      if (credentials == NULL && !g_error_matches (local_error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED))
++        {
++          g_propagate_error (error, local_error);
++          goto out;
++        }
++      else
++        {
++          /* Clear the error indicator, so we can retry with
++           * g_unix_connection_receive_credentials() if necessary */
++          g_clear_error (&local_error);
++        }
++    }
++#endif
++
++  if (credentials == NULL && G_IS_UNIX_CONNECTION (auth->priv->stream))
+     {
+       local_error = NULL;
+       credentials = g_unix_connection_receive_credentials (G_UNIX_CONNECTION (auth->priv->stream),
+-- 
+2.20.1
+
diff --git a/dev-libs/glib/glib-2.60.7-r1.ebuild b/dev-libs/glib/glib-2.60.7-r1.ebuild
new file mode 100644 (file)
index 0000000..7f37b17
--- /dev/null
@@ -0,0 +1,279 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python{3_5,3_6,3_7} )
+
+inherit flag-o-matic gnome.org gnome2-utils linux-info meson multilib multilib-minimal python-any-r1 toolchain-funcs xdg
+
+DESCRIPTION="The GLib library of C routines"
+HOMEPAGE="https://www.gtk.org/"
+
+LICENSE="LGPL-2.1+"
+SLOT="2"
+IUSE="dbus debug elibc_glibc fam gtk-doc kernel_linux +mime selinux static-libs systemtap test utils xattr"
+RESTRICT="!test? ( test )"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+# * libelf isn't strictly necessary, but makes gresource tool more useful, and
+# the check is automagic in gio/meson.build. gresource is not a multilib tool
+# right now, thus it doesn't matter if non-native ABI libelf exists or not
+# (non-native binary is overwritten, it doesn't matter if libelf was linked to).
+# * Technically static-libs is needed on zlib, util-linux and perhaps more, but
+# these are used by GIO, which glib[static-libs] consumers don't really seem
+# to need at all, thus not imposing the deps for now and once some consumers
+# are actually found to static link libgio-2.0.a, we can revisit and either add
+# them or just put the (build) deps in that rare consumer instead of recursive
+# RDEPEND here (due to lack of recursive DEPEND).
+RDEPEND="
+       !<dev-util/gdbus-codegen-${PV}
+       >=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
+       >=dev-libs/libpcre-8.31:3[${MULTILIB_USEDEP},static-libs?]
+       >=virtual/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
+       >=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+       >=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
+       kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
+       selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
+       xattr? ( !elibc_glibc? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] ) )
+       virtual/libelf:0=
+       fam? ( >=virtual/fam-0-r1[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}"
+# libxml2 used for optional tests that get automatically skipped
+BDEPEND="
+       app-text/docbook-xsl-stylesheets
+       dev-libs/libxslt
+       >=sys-devel/gettext-0.19.8
+       gtk-doc? ( >=dev-util/gtk-doc-1.20
+               app-text/docbook-xml-dtd:4.2
+               app-text/docbook-xml-dtd:4.5 )
+       systemtap? ( >=dev-util/systemtap-1.3 )
+       ${PYTHON_DEPS}
+       test? ( >=sys-apps/dbus-1.2.14 )
+       virtual/pkgconfig[${MULTILIB_USEDEP}]
+"
+# TODO: >=dev-util/gdbus-codegen-${PV} test dep once we modify gio/tests/meson.build to use external gdbus-codegen
+
+PDEPEND="
+       dbus? ( gnome-base/dconf )
+       mime? ( x11-misc/shared-mime-info )
+"
+# shared-mime-info needed for gio/xdgmime, bug #409481
+# dconf is needed to be able to save settings, bug #498436
+
+MULTILIB_CHOST_TOOLS=(
+       /usr/bin/gio-querymodules$(get_exeext)
+)
+
+pkg_setup() {
+       if use kernel_linux ; then
+               CONFIG_CHECK="~INOTIFY_USER"
+               if use test ; then
+                       CONFIG_CHECK="~IPV6"
+                       WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
+               fi
+               linux-info_pkg_setup
+       fi
+       python-any-r1_pkg_setup
+}
+
+src_prepare() {
+       eapply "${FILESDIR}"/${PV}-gdbus-fixes.patch #700538, included in 2.62.3+
+
+       if use test; then
+               # TODO: Review the test exclusions, especially now with meson
+               # Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
+               if ! has_version dev-util/desktop-file-utils ; then
+                       ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
+                       ewarn "think on installing it to get these tests run."
+                       sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
+                       sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
+               fi
+
+               # gdesktopappinfo requires existing terminal (gnome-terminal or any
+               # other), falling back to xterm if one doesn't exist
+               #if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
+               #       ewarn "Some tests will be skipped due to missing terminal program"
+               # These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
+               # Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready for backport (or in a bump) and file new issue if still fails
+               sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
+               # desktop-app-info/launch* might fail similarly
+               sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
+               #fi
+
+               # https://bugzilla.gnome.org/show_bug.cgi?id=722604
+               sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
+               sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
+
+               ewarn "Tests for search-utils have been skipped"
+               sed -i -e "/search-utils/d" glib/tests/meson.build || die
+
+               # Play nice with network-sandbox, but this approach would defeat the purpose of the test
+               #sed -i -e "s/localhost/127.0.0.1/g" gio/tests/gsocketclient-slow.c || die
+       else
+               # Don't build tests, also prevents extra deps, bug #512022
+               sed -i -e '/subdir.*tests/d' {.,gio,glib}/meson.build || die
+       fi
+
+       # Don't build fuzzing binaries - not used
+       sed -i -e '/subdir.*fuzzing/d' meson.build || die
+
+       # gdbus-codegen is a separate package
+       sed -i -e 's/install.*true/install : false/g' gio/gdbus-2.0/codegen/meson.build || die
+       # Older than meson-0.50 doesn't know about install kwarg for configure_file; for that we need to remove the install_dir kwarg.
+       # Upstream will remove the install kwarg in a future version to require only meson-0.49.2 or newer, at which point the
+       # install_dir removal only should be kept.
+       sed -i -e '/install_dir/d' gio/gdbus-2.0/codegen/meson.build || die
+
+       # Same kind of meson-0.50 issue with some installed-tests files; will likely be fixed upstream soon
+       sed -i -e '/install_dir/d' gio/tests/meson.build || die
+
+       cat > "${T}/glib-test-ld-wrapper" <<-EOF
+               #!/usr/bin/env sh
+               exec \${LD:-ld} "\$@"
+       EOF
+       chmod a+x "${T}/glib-test-ld-wrapper" || die
+       sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
+
+       xdg_src_prepare
+       gnome2_environment_reset
+       # TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
+}
+
+multilib_src_configure() {
+       if use debug; then
+               append-cflags -DG_ENABLE_DEBUG
+       else
+               append-cflags -DG_DISABLE_CAST_CHECKS # https://gitlab.gnome.org/GNOME/glib/issues/1833
+       fi
+
+       # TODO: figure a way to pass appropriate values for all cross properties that glib uses (search for get_cross_property)
+       #if tc-is-cross-compiler ; then
+               # https://bugzilla.gnome.org/show_bug.cgi?id=756473
+               # TODO-meson: This should be in meson cross file as 'growing_stack' property; and more, look at get_cross_property
+               #case ${CHOST} in
+               #hppa*|metag*) export glib_cv_stack_grows=yes ;;
+               #*)            export glib_cv_stack_grows=no ;;
+               #esac
+       #fi
+
+       local emesonargs=(
+               -Ddefault_library=$(usex static-libs both shared)
+               $(meson_feature selinux)
+               $(meson_use xattr)
+               -Dlibmount=true # only used if host_system == 'linux'
+               -Dinternal_pcre=false
+               -Dman=true
+               $(meson_use systemtap dtrace)
+               $(meson_use systemtap)
+               -Dgtk_doc=$(multilib_native_usex gtk-doc true false)
+               $(meson_use fam)
+               -Dinstalled_tests=false
+               -Dnls=enabled
+       )
+       meson_src_configure
+}
+
+multilib_src_compile() {
+       meson_src_compile
+}
+
+multilib_src_test() {
+       export XDG_CONFIG_DIRS=/etc/xdg
+       export XDG_DATA_DIRS=/usr/local/share:/usr/share
+       export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
+       export LC_TIME=C # bug #411967
+       unset GSETTINGS_BACKEND # bug #596380
+       python_setup
+
+       # Related test is a bit nitpicking
+       mkdir "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
+       chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
+
+       meson_src_test --timeout-multiplier 2 --no-suite flaky
+}
+
+multilib_src_install() {
+       meson_src_install
+       keepdir /usr/$(get_libdir)/gio/modules
+}
+
+multilib_src_install_all() {
+       einstalldocs
+
+       # These are installed by dev-util/glib-utils
+       # TODO: With patching we might be able to get rid of the python-any deps and removals, and test depend on glib-utils instead; revisit now with meson
+       rm "${ED}/usr/bin/glib-genmarshal" || die
+       rm "${ED}/usr/share/man/man1/glib-genmarshal.1" || die
+       rm "${ED}/usr/bin/glib-mkenums" || die
+       rm "${ED}/usr/share/man/man1/glib-mkenums.1" || die
+       rm "${ED}/usr/bin/gtester-report" || die
+       rm "${ED}/usr/share/man/man1/gtester-report.1" || die
+       # gdbus-codegen manpage installed by dev-util/gdbus-codegen
+       rm "${ED}/usr/share/man/man1/gdbus-codegen.1" || die
+}
+
+pkg_preinst() {
+       xdg_pkg_preinst
+
+       # Make gschemas.compiled belong to glib alone
+       local cache="/usr/share/glib-2.0/schemas/gschemas.compiled"
+
+       if [[ -e ${EROOT}${cache} ]]; then
+               cp "${EROOT}"${cache} "${ED}"/${cache} || die
+       else
+               touch "${ED}"${cache} || die
+       fi
+
+       multilib_pkg_preinst() {
+               # Make giomodule.cache belong to glib alone
+               local cache="/usr/$(get_libdir)/gio/modules/giomodule.cache"
+
+               if [[ -e ${EROOT}${cache} ]]; then
+                       cp "${EROOT}"${cache} "${ED}"${cache} || die
+               else
+                       touch "${ED}"${cache} || die
+               fi
+       }
+
+       # Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
+       # file due to inability to create it and GIO might not look at any of the modules there
+       if ! tc-is-cross-compiler ; then
+               multilib_foreach_abi multilib_pkg_preinst
+       fi
+}
+
+pkg_postinst() {
+       xdg_pkg_postinst
+       # glib installs no schemas itself, but we force update for fresh install in case
+       # something has dropped in a schemas file without direct glib dep; and for upgrades
+       # in case the compiled schema format could have changed
+       gnome2_schemas_update
+
+       multilib_pkg_postinst() {
+               gnome2_giomodule_cache_update \
+                       || die "Update GIO modules cache failed (for ${ABI})"
+       }
+       if ! tc-is-cross-compiler ; then
+               multilib_foreach_abi multilib_pkg_postinst
+       else
+               ewarn "Updating of GIO modules cache skipped due to cross-compilation."
+               ewarn "You might want to run gio-querymodules manually on the target for"
+               ewarn "your final image for performance reasons and re-run it when packages"
+               ewarn "installing GIO modules get upgraded or added to the image."
+       fi
+}
+
+pkg_postrm() {
+       xdg_pkg_postrm
+       gnome2_schemas_update
+
+       if [[ -z ${REPLACED_BY_VERSION} ]]; then
+               multilib_pkg_postrm() {
+                       rm -f "${EROOT}"/usr/$(get_libdir)/gio/modules/giomodule.cache
+               }
+               multilib_foreach_abi multilib_pkg_postrm
+               rm -f "${EROOT}"/usr/share/glib-2.0/schemas/gschemas.compiled
+       fi
+}