Bug#1064783: apt-listbugs: installs same filename to both bin and sbin

[Francesco Poli]

Control: tags -1 - moreinfo
Control: severity -1 wishlist


On Mon, 26 Feb 2024 11:08:29 + ca...@allfreemail.net wrote:

> Source: apt-listbugs
> Followup-For: Bug #1064783
> 
> > The command 'apt-listbugs' is installed to /usr/bin and a symbolic link
> > to it is installed to /usr/sbin .
> 
> You are correct, and on a filesystem where those locations are the same
> it causes unpacking errors.

Yes, that's clear.

> 
> > This layout is not currently supported by Debian, as far as I can tell.
> 
> It is not yet supported on debian, but using debootstrap instead of
> debian-installer makes it possible to create such a filesystem layout.
> This is currently useful for testing how adding /usr/sbin to default
> user $PATH would break, and how merging /usr/sbin and /usr/bin would
> break.
> 
> > Which distributions?
> 
> Archlinux has had merged bin and sbin for a number of years. Fedora is
> going in that direction soon and made a nice writeup on 
> https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin

An interesting read, although some of the considerations do not seem to
apply to Debian.

For instance, as far as I can see, in Debian the superuser (root) gets
a different default $PATH (which includes sbin directories), with
respect to regular users (who, by default, do not have sbin directories
in their $PATH). Hence, I would say that the distinction between /bin
and /sbin is not meaningless in Debian...

> 
> > I am not aware of any plans in Debian to move in that direction.
> 
> So far it has been briefly discussed in the -devel channel on IRC and
> the idea has been received mostly well. There are bigger problems with
> it, such as different packages having undeclared file conflicts if the
> sbinmerge happenen, however it is a nice low-hanging fruit to first fix
> the few packages where the one package unpacks the same file (or
> symlink) to both bin and sbin.

I see, but I am a bit worried of breaking scripts with hardcoded paths.

> 
> > See the [usrmerge FAQ], which includes, in part:
> 
> You are correct, this is not about the current usrmerge. It could be called
> usrmerge2.0 or sbinmerge or some other term.

OK, let's call it sbinmerge, then.

> 
> > Could you please elaborate a bit more on why you think this feature of
> > the apt-listbugs Debian package could be an issue?
> 
> On a filesystem where bin and sbin are merged, it causes an unpacking
> error during installation of the package, due to the symlink trying to
> overwrite the real file, or the real file overwriting the symlink. It is
> in a way a file conflict - it can be silenced by passing the right flags
> to the commands, but it is better to fix it properly.

Sorry, I wasn't clear: I understand why unpacking conflicting files
across /sbin and /bin causes issues on a system where /sbin and /bin
are the same directory.

I was asking you to elaborate on why this could be an issue in Debian,
which does not currently support a layout where /sbin and /bin are the
same directory.
And the answer (judging from the rest of your reply) is basically
"because some people in Debian are considering the possibility to
merge /sbin and /bin in some unspecified future, and it would be nice,
if as few packages as possible hampered this possible transition".

> 
> > Which other distributions (Debian-derivatives or otherwise) include
> > apt-listbugs?
> 
> I don't know of any.
> 
> > I am a bit hesitant to do so (risking to break random custom scripts),
> > unless there's a good reason.
> 
> The idea of merging bin and sbin is exactly to help with random custom
> scripts, because if bin and sbin are the same directory, then it doesn't
> matter if only bin or only sbin is in $PATH, or if the executable is
> called directly using hardcoded /usr/bin/apt-listbugs or /usr/sbin/listbugs,
> because both ways will then work instead of giving "command not found"
> errors.
> 
> However I agree that in the meantime some random script somewhere could
> break, and so such a change might warrant a NEWS entry.

Exactly, I am a bit worried about the meantime.

However, you replied to my questions (that's why I am dropping the
'moreinfo' tag).
It's now clear to me, that you are not asking me to modify apt-listbugs
for other distributions, but to simplify a possible future sbinmerge in
Debian.
That sounds like a legitimate feature request (hence severity
'wishlist').

I will think about it.
Bye!


-- 
 http://www.inventati.org/frx/
 There's not a second to spare! To the laboratory!
. Francesco Poli .
 GnuPG key fpr == CA01 1147 9CD2 EFDF FB82  3925 3E1C 27E1 1F69 BFFE


pgpGJRNrIwPsh.pgp
Description: PGP signature

Bug#1064783: apt-listbugs: installs same filename to both bin and sbin

[cacin]

Source: apt-listbugs
Followup-For: Bug #1064783

> The command 'apt-listbugs' is installed to /usr/bin and a symbolic link
> to it is installed to /usr/sbin .

You are correct, and on a filesystem where those locations are the same
it causes unpacking errors.

> This layout is not currently supported by Debian, as far as I can tell.

It is not yet supported on debian, but using debootstrap instead of
debian-installer makes it possible to create such a filesystem layout.
This is currently useful for testing how adding /usr/sbin to default
user $PATH would break, and how merging /usr/sbin and /usr/bin would
break.

> Which distributions?

Archlinux has had merged bin and sbin for a number of years. Fedora is
going in that direction soon and made a nice writeup on 
https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin

> I am not aware of any plans in Debian to move in that direction.

So far it has been briefly discussed in the -devel channel on IRC and
the idea has been received mostly well. There are bigger problems with
it, such as different packages having undeclared file conflicts if the
sbinmerge happenen, however it is a nice low-hanging fruit to first fix
the few packages where the one package unpacks the same file (or
symlink) to both bin and sbin.

> See the [usrmerge FAQ], which includes, in part:

You are correct, this is not about the current usrmerge. It could be called
usrmerge2.0 or sbinmerge or some other term.

> Could you please elaborate a bit more on why you think this feature of
> the apt-listbugs Debian package could be an issue?

On a filesystem where bin and sbin are merged, it causes an unpacking
error during installation of the package, due to the symlink trying to
overwrite the real file, or the real file overwriting the symlink. It is
in a way a file conflict - it can be silenced by passing the right flags
to the commands, but it is better to fix it properly.

> Which other distributions (Debian-derivatives or otherwise) include
> apt-listbugs?

I don't know of any.

> I am a bit hesitant to do so (risking to break random custom scripts),
> unless there's a good reason.

The idea of merging bin and sbin is exactly to help with random custom
scripts, because if bin and sbin are the same directory, then it doesn't
matter if only bin or only sbin is in $PATH, or if the executable is
called directly using hardcoded /usr/bin/apt-listbugs or /usr/sbin/listbugs,
because both ways will then work instead of giving "command not found"
errors.

However I agree that in the meantime some random script somewhere could
break, and so such a change might warrant a NEWS entry.

Bug#1064783: apt-listbugs: installs same filename to both bin and sbin

[Francesco Poli]

Control: tags -1 + moreinfo


On Sun, 25 Feb 2024 21:36:44 + ca...@allfreemail.net wrote:

[...]
> Dear Maintainer,
> 
> your package installs the filename apt-listbugs to both bin and sbin as 
> opposed to just one of those locations.

Hello,
thanks for your bug report.

The command 'apt-listbugs' is installed to /usr/bin and a symbolic link
to it is installed to /usr/sbin .

A long time ago, the package used to only install the command
to /usr/sbin , but apt-listbugs may be useful for unprivileged users
too (for some of its functionalities), hence it was moved to /usr/bin ,
with a symlink from /usr/sbin for backward compatibility (to avoid
breaking possible custom scripts with the full path hardcoded...).

> 
> This causes a problem on a filesystem layout where bin and sbin are merged 
> into a single real directory, typically by sbin being a symlink to bin.

This layout is not currently supported by Debian, as far as I can tell.

> Such a filesystem layout has become standard on some distributions now, and 
> others are moving onto in their next releases.

Which distributions?

I am not aware of any plans in Debian to move in that direction.

See the [usrmerge FAQ], which includes, in part:

[...]
| Is this about merging /usr/bin/ and /usr/sbin/?
|
| No, there are no plans to do that.
[...]

[usrmerge FAQ]: 


Could you please elaborate a bit more on why you think this feature of
the apt-listbugs Debian package could be an issue?

Which other distributions (Debian-derivatives or otherwise) include
apt-listbugs?
Without massive modifications, apt-listbugs can only be useful for
APT-based distributions with a debbugs-based bug tracking system.
As far as I know, there are no other such distributions beyond Debian.
Do you happen to know any?

> 
> Please pick one location and install it only there. /usr/bin is preferred 
> over any other location.

I am a bit hesitant to do so (risking to break random custom scripts),
unless there's a good reason.

If you explain which distributions are or could be affected by this
feature of apt-listbugs, I will think about it.
Otherwise, I can close this bug report, since what you are reporting
does not seem to be an actual issue for Debian.

> 
> Thank you for maintaining software in debian.

You're welcome.
Thanks to you for caring about apt-listbugs!



-- 
 http://www.inventati.org/frx/
 There's not a second to spare! To the laboratory!
. Francesco Poli .
 GnuPG key fpr == CA01 1147 9CD2 EFDF FB82  3925 3E1C 27E1 1F69 BFFE


pgpWZUaklR6aJ.pgp
Description: PGP signature

Bug#1064783: apt-listbugs: installs same filename to both bin and sbin

[cacin]

Source: apt-listbugs
Version: 0.1.41
Severity: normal

Dear Maintainer,

your package installs the filename apt-listbugs to both bin and sbin as opposed 
to just one of those locations.

This causes a problem on a filesystem layout where bin and sbin are merged into 
a single real directory, typically by sbin being a symlink to bin. Such a 
filesystem layout has become standard on some distributions now, and others are 
moving onto in their next releases.

Please pick one location and install it only there. /usr/bin is preferred over 
any other location.

Thank you for maintaining software in debian.