Re: PORTS_PRIVSEP=Yes and doas install

On Thu, Mar 26, 2020 at 02:17:04PM +0000, Lucas wrote:
> Marc Espie <espie@nerim.net> wrote:
> > On Thu, Mar 26, 2020 at 01:37:30PM +0000, Lucas wrote:
> > > Marc Espie <espie@nerim.net> wrote:
> > > > No, it's just a question of giving cache/ to the right user, there's no
> > > > need for a complete new set of variables.
> > >
> > > Then I can only think of moving _CACHE_REPO under DISTDIR. I can
> > > prepare a patch for that too, if it's the direction to take.
> > >
> > > -Lucas
> > >
> > Why ? there's no problem having separate ownership of stuff under
> > packages
>
> I consider being asked a password a problem (we can't make unattended
> builds if FETCH_PACKAGES isn't No) and I don't feel that adding
>
> permit nopass lucas cmd install
>
> to doas.conf is the correct solution.
>
> At the very least, it should be noted somewhere that PORTS_PRIVSEP=Yes
> and FETCH_PACKAGES != No don't play well together and changes to
> doas.conf have to be made in order for not being asked frequently for
> passwords.
>
> >From my ignorance, I think assigning _CACHE_REPO under DISTDIR is
> non-invassive enough. I have yet to check what kind of files go under
> DISTDIR and if it would conflict having ${MACHINE_ARCHITECTURE}/cache
> in there.
>

Look I'll have to try and reproduce your issue, but basically we create
lots of dirs with different ownership in "fix-permissions"
_CACHE_REPO is missing in there, and it's very likely it's all that's
actually needed.

Index: bsd.port.mk
===================================================================
RCS file: /cvs/ports/infrastructure/mk/bsd.port.mk,v
retrieving revision 1.1526
diff -u -p -r1.1526 bsd.port.mk
--- bsd.port.mk 24 Mar 2020 17:33:43 -0000 1.1526
+++ bsd.port.mk 26 Mar 2020 14:37:42 -0000
@@ -2056,7 +2056,9 @@ fix-permissions:
else \
install -o ${FETCH_USER} -g $$f -d ${DISTDIR}; \
fi
-. for d in ${LOCKDIR} ${PACKAGE_REPOSITORY} ${PLIST_REPOSITORY} ${WRKOBJDIR}
+. for d in ${LOCKDIR} ${PACKAGE_REPOSITORY} \
+ ${PACKAGE_REPOSITORY}/${MACHINE_ARCH} \
+ ${PLIST_REPOSITORY} ${WRKOBJDIR}
@b=`id -gn ${BUILD_USER}`; \
echo "give $d to ${BUILD_USER}:$$b"; \
if test -d $d; then \
@@ -2065,6 +2067,13 @@ fix-permissions:
install -o ${BUILD_USER} -g $$b -d $d; \
fi
. endfor
+ @f=`id -gn ${FETCH_USER}`; \
+ echo "give ${_CACHE_REPO} to ${FETCH_USER}:$$f"; \
+ if test -d ${_CACHE_REPO}; then \
+ cd ${_CACHE_REPO} && chown -R ${FETCH_USER}:$$f .; \
+ else \
+ install -o ${FETCH_USER} -g $$f -d $${_CACHE_REPO}; \
+ fi
.endif

.for _S in ${MULTI_PACKAGES}