Quality Assurance: Testing and Linting

Updated

October 30, 2026

Quality Assurance: Testing and Linting

Before a newly compiled package enters your distribution’s repository, it must pass automated Quality Assurance (QA) linting. A defective package can break the dynamic linker, overwrite critical system files, or introduce security vulnerabilities.

+-----------------------------------------------------------+
|                    Package QA Audit Pipeline              |
|                                                           |
| 1. Namcap / Lintian Checks (Metadata & policy adherence)  |
| 2. File Conflict Audit (No overlapping paths with others) |
| 3. Dynamic Linker & RPATH Validation (readelf / scanelf)  |
| 4. Security Hardening Audit (checksec / hardening-check)  |
| 5. Isolated Chroot Installation Test                      |
+-----------------------------------------------------------+

1. RPATH / RUNPATH Poisoning Audit

DT_RPATH and DT_RUNPATH are ELF header fields instructing the dynamic linker where to search for shared libraries before consulting /etc/ld.so.conf or /usr/lib.

If a build script accidentally embeds a temporary build path:

$ readelf -d /mnt/target/usr/bin/foo | grep -E 'RPATH|RUNPATH'
 0x000000000000001d (RUNPATH)            Library runpath: [/home/builder/src/foo/.libs]

This is a critical security bug! If an attacker can write to /home/builder/..., they can inject malicious shared libraries into standard binaries.

QA Rule: Reject any package whose binaries contain references to temporary build directories in their RPATH or RUNPATH. Use chrpath --delete or patchelf to strip them before packaging.

2. Hardening Audit with checksec

Verify that all binaries were compiled with modern security flags:

$ checksec --file=/mnt/target/usr/bin/curl
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH
Full RELRO      Canary found      NX enabled    PIE enabled     No RPATH   No RUNPATH
  • Full RELRO: GOT is read-only.
  • Canary found: Stack smashing protection active.
  • NX enabled: Non-executable stack (prevents executing shellcode on the stack).
  • PIE enabled: Position Independent Executable (ASLR supported).

3. Undeclared Shared Library Dependencies

A binary cannot work if its runtime dependencies are not declared in the package manifest:

# Scan binary for direct shared library dependencies:
$ scanelf -n /mnt/target/usr/bin/curl
TYPE    NEEDED FILE
ET_DYN  libcurl.so.4,libz.so.1,libc.so.6 /mnt/target/usr/bin/curl

The QA pipeline verifies that zlib and glibc are explicitly listed in the package’s runtime_dependencies list in PACKAGE.toml.