ports/182909: Ports should sanitize the environment

[Julio Merino]

>Number:         182909
>Category:       ports
>Synopsis:       Ports should sanitize the environment
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Oct 11 18:20:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Julio Merino
>Release:        FreeBSD 10.0-ALPHA5 powerpc
>Organization:
>Environment:
System: FreeBSD mastodon.meroh.net 10.0-ALPHA5 FreeBSD 10.0-ALPHA5 #6 r256122M: Tue Oct 8 07:26:36 EDT 2013 jmmv at mastodon.meroh.net:/usr/obj/usr/src/sys/GENERIC64 powerpc


	
>Description:
	Yesterday, while building a port that I knew worked, it mysteriously
	failed due to a symbol being missing in a dependent library.
	
	The reason was that I had PKG_CONFIG_PATH set in the environment
	pointing to my home directory, and the build of the package from ports
	picked a different version of the dependency than the one in ports.

	I think ports should sanitize the environment to prevent the build of
	a package from picking dependencies that are not in ${PREFIX} nor in
	the base system.
	
	At the very least, this means clearing PKG_CONFIG_PATH.  I'd imagine
	that removing unexpected -I and -L flags from C*FLAGS and LDFLAGS
	would also be beneficial, but this seems trickier to achieve.
>How-To-Repeat:
	1) Install lutok 0.3 in ~/local.
	2) Set PKG_CONFIG_PATH=${HOME}/local in your environment.
	3) Attempt to build devel/kyua (version 0.6) and see it fail.
>Fix:
	Possibly setting PKG_CONFIG_PATH= in the right place of bsd.port.mk
	is sufficient.  I'm not sure about what exactly that place is though.
>Release-Note:
>Audit-Trail:
>Unformatted: