Your message dated Wed, 04 Jul 2018 17:37:33 +0200
with message-id <153071865300.28626.12033447715180253070@localhost>
and subject line Re: sbuild: world-readable key file for recent versions of apt
has caused the Debian Bug report #864390,
regarding sbuild: world-readable key file for recent versions of apt
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
864390: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864390
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: sbuild
Version: 0.73.0-4+0~roam1
Severity: important
Tags: patch
Hi,
First of all, thanks for maintaining and developing sbuild!
Recent versions of apt started dropping privileges to an _apt
user account; thus, the keyring file that sbuild creates for
use in the chroot is no longer readable by apt, so it issues
a warning, exits with a non-zero code, and breaks the build.
What do you think about the attached two patches? The second
one fixes the problem itself; the first one is a drive-by fix.
Thanks again for your work on sbuild and Debian in general!
G'luck,
Peter
-- System Information:
Debian Release: 9.0
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.9.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages sbuild depends on:
ii adduser 3.115
ii libsbuild-perl 0.73.0-4+0~roam1
ii perl 5.24.1-3
Versions of packages sbuild recommends:
ii autopkgtest 4.4
ii debootstrap 1.0.89
ii schroot 1.7.2-3
Versions of packages sbuild suggests:
ii deborphan 1.7.28.8-0.3+b1
ii kmod 23-2
ii wget 1.18-5
-- no debconf information
From eec3335c7e62658325e65e56d1ce873382bad499 Mon Sep 17 00:00:00 2001
From: Peter Pentchev <[email protected]>
Date: Wed, 7 Jun 2017 22:28:39 +0300
Subject: [PATCH 1/2] Check the result of a rename() operation
---
lib/Sbuild/ResolverBase.pm | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/lib/Sbuild/ResolverBase.pm b/lib/Sbuild/ResolverBase.pm
index 24d14643..78f00b75 100644
--- a/lib/Sbuild/ResolverBase.pm
+++ b/lib/Sbuild/ResolverBase.pm
@@ -1383,7 +1383,11 @@ EOF
&$kill_gpgagent();
return 0;
}
- $session->rename($tmpfilename, $self->get('Dummy archive key file'));
+ if (!$session->rename($tmpfilename, $self->get('Dummy archive key
file'))) {
+ $self->log("Failed to rename the dummy archive key.\n");
+ &$kill_gpgagent();
+ return 0;
+ }
&$kill_gpgagent();
}
--
2.11.0
From 86c5720ba2b8f9a0093ff549ac54541abe837185 Mon Sep 17 00:00:00 2001
From: Peter Pentchev <[email protected]>
Date: Wed, 7 Jun 2017 22:29:48 +0300
Subject: [PATCH 2/2] Make the dummy archive key file world-readable
Recent versions of apt drop privileges by switching to the _apt
user account.
---
lib/Sbuild/ResolverBase.pm | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lib/Sbuild/ResolverBase.pm b/lib/Sbuild/ResolverBase.pm
index 78f00b75..deb36172 100644
--- a/lib/Sbuild/ResolverBase.pm
+++ b/lib/Sbuild/ResolverBase.pm
@@ -1388,6 +1388,11 @@ EOF
&$kill_gpgagent();
return 0;
}
+ if (!$session->chmod($self->get('Dummy archive key file'), '0644')) {
+ $self->log("Failed to set the permissions on the dummy archive
key.\n");
+ &$kill_gpgagent();
+ return 0;
+ }
&$kill_gpgagent();
}
--
2.11.0
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Hi,
On Thu, 22 Mar 2018 11:16:50 +0200 Peter Pentchev <[email protected]> wrote:
> APT 1.5 only issues a warning now, does not exit with an error,
> so I'm lowering the severity of this bug. Still it would be nice
> to not even have the warning :)
thanks for working on sbuild!
Unfortunately (as also written in a comment) the area of code you edited was
only still there for support for Debian Squeeze and LTS support for Squeeze
ended over two years ago. Thus, with the next sbuild release I'm removing the
whole kaboodle.
Sorry. XD
cheers, josch
signature.asc
Description: signature
--- End Message ---
