Bug 71022

Same error on ubuntu 12.04

$ apt-cache policy expat
expat:
  Installed: 2.0.1-7.2ubuntu1.1
  Candidate: 2.0.1-7.2ubuntu1.1

Looks like expat.pc was added in expat 2.1.  2.0 doesn't install it, so mesa's pkg-config check fails.

$ pkg-config --cflags --libs expat
Package expat was not found in the pkg-config search path.
Perhaps you should add the directory containing `expat.pc'
to the PKG_CONFIG_PATH environment variable
No package 'expat' found

Reverting patch aec20d66 enables it to pass the configure check.

commit aec20d66d9d13e0acd6a7199b63e1383e1e9900a
Author: Emil Velikov <emil.l.velikov@gmail.com>
Date:   Tue Oct 29 21:14:41 2013 +0000

    automake: properly handle non-default expat installation

expat-2.1.0 was released March 24 2012. That's kind of a long time for it to not be in your distribution.

I'm personally okay with requiring 2.1.0, but I suppose people want new Mesa on old things.

I might suggest checking whether the pkgconfig file exists, and if it does do the regular PKG_CHECK_MODULES check, otherwise just set EXPAT_LIBS=-lexpat. Might work for everyone affected.

(In reply to comment #3)
> expat-2.1.0 was released March 24 2012. That's kind of a long time for it to
> not be in your distribution.
> 
> I'm personally okay with requiring 2.1.0, but I suppose people want new Mesa
> on old things.
> 
> I might suggest checking whether the pkgconfig file exists, and if it does
> do the regular PKG_CHECK_MODULES check, otherwise just set
> EXPAT_LIBS=-lexpat. Might work for everyone affected.

Expat 2.0.1 Released 2007-06-06

I honestly hope that distros will update this piece of software, considering CVE-2012-1147 and CVE-2012-1148 (both affecting version 2.0 and earlier). Might be worth pinging the package maintainers.

But in the meantime, Matt's suggestion sounds great.

Created attachment 88328 [details] [review]
Hardcode EXPAT in configure.ac

expat 2.0 does not provide the pkgconfig file.

Hardcoding EXPAT as suggested, does fix the build locally for me.

Ubuntu 12.04 is an LTS and follows a conservative policy for updating libs, thus I would not expect them to want to update to 2.1, but they do sometimes backport specific stable fixes.  They've done so for CVE-2012-1148, but not afaict
CVE-2012-1147.

CVE-2012-1147 was determined not to be relevant on Ubuntu:

http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-1147.html

Created attachment 88329 [details] [review]
handle expat versions pre 2.1

(In reply to comment #6)
> CVE-2012-1147 was determined not to be relevant on Ubuntu:
> 
> http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-1147.html

Fair enough, I would personally do with using the new version but that's just me.

The attached patch should work like a charm (tested and working fine here).

Yep, that does the trick.

Tested-by: Bryce Harrington <b.harrington@samsung.com>

fwiw, this would be nice to push.. it would at least fix my tinderbox:
http://tinderbox.x.org/builds/2013-10-30-0017/logs/libGL/#configure

Pushed to master, sorry for the breakage guys.

commit 9eb3de1ce7acb59a8b38ddcef20366620ff02b60
Author: Emil Velikov <emil.l.velikov@gmail.com>
Date:   Wed Oct 30 00:03:43 2013 +0000

    automake: handle expat version pre 2.1