Re: [Rpm-maint] [rpm-software-management/rpm] RFE: support isolation between %prep/%build/%install/%check (Issue #3050)

2024-04-19 Thread Panu Matilainen
Yup. Note "ideally" in there - this is stuff to explore with, and indeed for 
packaging hygiene reasons rather than any "security" thing.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3050#issuecomment-2065908096
You are receiving this because you are subscribed to this thread.

Message ID: ___
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint


Re: [Rpm-maint] [rpm-software-management/rpm] RFE: support isolation between %prep/%build/%install/%check (Issue #3050)

2024-04-19 Thread Zbigniew Jędrzejewski-Szmek
> %install should run with a read-only build directory

I don't think this is going to work. E.g. autotoolz-based systems (something in 
the autotools, automake, libconf stack) do final preparation steps in the 
install target. I think this is inelegant, but not really "wrong". Old meson 
versions had a buglet in the i18n module where the po file would be generated 
not during build but during installation. But more widely, tools write 
installation logs into the build directory. Meson does, I think various Python 
tools do (pip?), etc. Anything that gives an "uninstall" command needs to put 
the information somewhere.

> %check should run with read-only buildroot to prevent tests from affecting 
> packaged content.

People were asking about this a lot in #3010. My motivation for this: build 
hygiene and reproducibility. The `%check` section is optional and can be 
skipped with `--nocheck` or `--without tests`. The result of a build that 
skipped checks should be identical, which would break if anything in `%check` 
touches `%{buildroot}`. If `%{buildroot}` is made readonly, we know that we can 
skip checks safely and save time. For example, when doing build reproducibility 
checks, I'd skip tests, because we're not interested in their result at all, 
but we can do that safely only if we are sure that they don't influence package 
contents.

> It probably does need writable build-dir because those tests do need to write 
> someplace

And same with install: I have seen various sources generate stuff needed for 
tests in check targets, not build. In summary, I think that in practice all 
phases must be given write access to the build directory.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3050#issuecomment-2065876550
You are receiving this because you are subscribed to this thread.

Message ID: ___
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint