Bug#1089300: checkinstall: Supporting rootless builds by default

Niels Thykier Sat, 07 Dec 2024 10:54:27 -0800

Source: checkinstall
Version: 1.6.2+git20170426.d24a630-5
Severity: important
Tags: ftbfs
Justification: FTBFS
X-Debbugs-Cc: ni...@thykier.net
User: ni...@thykier.net
Usertags: rrr-no-as-default-issue


Dear maintainer,

During a test rebuild for building packages with
`Rules-Requires-Root: no` as the default in `dpkg`,
checkinstall failed to rebuild.

Log Summary:
-------------------------------------------------------------------------------
[...]
Using /tmp/installwatch-test and /tmp/installwatch-test2 as a test files

Testing chmod... wanted refcount=3 returned refcount=3passed
Testing chown... wanted refcount=6 returned refcount=6passed
Testing chroot... wanted refcount=7 returned refcount=7passed
Testing creat... wanted refcount=9 returned refcount=9passed
Testing fchmod... wanted refcount=12 returned refcount=12passed
Testing fchown... wanted refcount=15 returned refcount=15passed
Testing fopen... wanted refcount=17 returned refcount=17passed
Testing ftruncate... wanted refcount=20 returned refcount=20passed
Testing lchown... wanted refcount=23 returned refcount=23passed
Testing link... wanted refcount=27 returned refcount=27passed
Testing mkdir... wanted refcount=29 returned refcount=29passed
Testing open... wanted refcount=31 returned refcount=31passed
Testing rename... wanted refcount=34 returned refcount=34passed
Testing rmdir... wanted refcount=36 returned refcount=36passed
Testing symlink... wanted refcount=40 returned refcount=40passed
Testing truncate... wanted refcount=43 returned refcount=43passed
Testing unlink... wanted refcount=45 returned refcount=45passed

All tests successful!
make[2]: Leaving directory '/<<PKGBUILDDIR>>/installwatch'
rm -rf /<<PKGBUILDDIR>>/debian/testtmp
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
   create-stamp debian/debhelper-build-stamp
   dh_prep
   debian/rules override_dh_auto_install
make[1]: Entering directory '/<<PKGBUILDDIR>>'
# We override all paths: we want the binary in bin instead of
# sbin, the configuration file in etc, the locales in the
# standard directory, and the installwatch library in a subdir
# of usr/lib

/usr/bin/make install PREFIX=/<<PKGBUILDDIR>>/debian/tmp/usr LCDIR=/<<PKGBUILDDIR>>/debian/tmp/usr/share/locale \ CONFDIR=/<<PKGBUILDDIR>>/debian/tmp/etc BINDIR=/<<PKGBUILDDIR>>/debian/tmp/usr/bin \

        LIBDIR=/<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall
make[2]: Entering directory '/<<PKGBUILDDIR>>'
for file in locale/checkinstall-*.po ; do \
        case ${file} in \
                locale/checkinstall-template.po)  ;; \
                *) \
                        out=`echo $file | sed -s 's/po/mo/'` ; \
                        msgfmt -o ${out} ${file} ; \
                        if [ $? != 0 ] ; then \
                                exit 1 ; \
                        fi ; \
                ;; \
        esac ; \
done

sed 's%MAKEFILE_PREFIX%/<<PKGBUILDDIR>>/debian/tmp/usr%g' checkinstall.in > checkinstall

/usr/bin/make -C installwatch
make[3]: Entering directory '/<<PKGBUILDDIR>>/installwatch'
make[3]: Nothing to be done for 'all'.
make[3]: Leaving directory '/<<PKGBUILDDIR>>/installwatch'
export
export APT_CONFIG='/var/lib/sbuild/apt.conf'
export ASFLAGS=''
export ASFLAGS_FOR_BUILD=''
export BINDIR='/<<PKGBUILDDIR>>/debian/tmp/usr/bin'

export CFLAGS='-g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard' export CFLAGS_FOR_BUILD='-g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard'

export CONFDIR='/<<PKGBUILDDIR>>/debian/tmp/etc'
export CPPFLAGS='-Wdate-time -D_FORTIFY_SOURCE=2'
export CPPFLAGS_FOR_BUILD='-Wdate-time -D_FORTIFY_SOURCE=2'

export CXXFLAGS='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard' export CXXFLAGS_FOR_BUILD='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard'

export DEB_BUILD_ARCH='arm64'
export DEB_BUILD_ARCH_ABI='base'
export DEB_BUILD_ARCH_BITS='64'
export DEB_BUILD_ARCH_CPU='arm64'
export DEB_BUILD_ARCH_ENDIAN='little'
export DEB_BUILD_ARCH_LIBC='gnu'
export DEB_BUILD_ARCH_OS='linux'
export DEB_BUILD_GNU_CPU='aarch64'
export DEB_BUILD_GNU_SYSTEM='linux-gnu'
export DEB_BUILD_GNU_TYPE='aarch64-linux-gnu'
export DEB_BUILD_MULTIARCH='aarch64-linux-gnu'
export DEB_BUILD_OPTIONS='parallel=8'
export DEB_HOST_ARCH='arm64'
export DEB_HOST_ARCH_ABI='base'
export DEB_HOST_ARCH_BITS='64'
export DEB_HOST_ARCH_CPU='arm64'
export DEB_HOST_ARCH_ENDIAN='little'
export DEB_HOST_ARCH_LIBC='gnu'
export DEB_HOST_ARCH_OS='linux'
export DEB_HOST_GNU_CPU='aarch64'
export DEB_HOST_GNU_SYSTEM='linux-gnu'
export DEB_HOST_GNU_TYPE='aarch64-linux-gnu'
export DEB_HOST_MULTIARCH='aarch64-linux-gnu'
export DEB_RULES_REQUIRES_ROOT='no'
export DEB_TARGET_ARCH='arm64'
export DEB_TARGET_ARCH_ABI='base'
export DEB_TARGET_ARCH_BITS='64'
export DEB_TARGET_ARCH_CPU='arm64'
export DEB_TARGET_ARCH_ENDIAN='little'
export DEB_TARGET_ARCH_LIBC='gnu'
export DEB_TARGET_ARCH_OS='linux'
export DEB_TARGET_GNU_CPU='aarch64'
export DEB_TARGET_GNU_SYSTEM='linux-gnu'
export DEB_TARGET_GNU_TYPE='aarch64-linux-gnu'
export DEB_TARGET_MULTIARCH='aarch64-linux-gnu'
export DFLAGS='-frelease'
export DFLAGS_FOR_BUILD='-frelease'
export DH_INTERNAL_BUILDFLAGS='1'
export DH_INTERNAL_OPTIONS=''
export DH_INTERNAL_OVERRIDE='dh_auto_install'

export FCFLAGS='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -mbranch-protection=standard' export FCFLAGS_FOR_BUILD='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -mbranch-protection=standard' export FFLAGS='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -mbranch-protection=standard' export FFLAGS_FOR_BUILD='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -mbranch-protection=standard'

export HOME='/sbuild-nonexistent'
export LANG='en_US.UTF-8'
export LCDIR='/<<PKGBUILDDIR>>/debian/tmp/usr/share/locale'
export LC_ALL='C.UTF-8'
export LDFLAGS='-Wl,-z,relro'
export LDFLAGS_FOR_BUILD='-Wl,-z,relro'
export LIBDIR='/<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall'
export LOGNAME='debusine-worker'

export MAKEFLAGS='w -- LIBDIR=/<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall BINDIR=/<<PKGBUILDDIR>>/debian/tmp/usr/bin CONFDIR=/<<PKGBUILDDIR>>/debian/tmp/etc LCDIR=/<<PKGBUILDDIR>>/debian/tmp/usr/share/locale PREFIX=/<<PKGBUILDDIR>>/debian/tmp/usr'

export MAKELEVEL='3'
export MAKEOVERRIDES='${-*-command-variables-*-}'
export MFLAGS='-w'

export OBJCFLAGS='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard' export OBJCFLAGS_FOR_BUILD='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard' export OBJCXXFLAGS='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard' export OBJCXXFLAGS_FOR_BUILD='-g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard' export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games'

export PREFIX='/<<PKGBUILDDIR>>/debian/tmp/usr'
export PWD='/<<PKGBUILDDIR>>'
export SHELL='/bin/sh'
export SOURCE_DATE_EPOCH='1726032284'
export USER='debusine-worker'
/usr/bin/make -C installwatch install
make[3]: Entering directory '/<<PKGBUILDDIR>>/installwatch'
mkdir -p /<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall
mkdir -p /<<PKGBUILDDIR>>/debian/tmp/usr/bin

if [ -r /<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall/installwatch.so ]; then \

        rm -f  
/<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall/installwatch.so; \
fi
install installwatch.so /<<PKGBUILDDIR>>/debian/tmp/usr/lib/checkinstall

sed -e "s|#PREFIX#|/<<PKGBUILDDIR>>/debian/tmp/usr|" < installwatch > /<<PKGBUILDDIR>>/debian/tmp/usr/bin/installwatch

chmod 755 /<<PKGBUILDDIR>>/debian/tmp/usr/bin/installwatch
make[3]: Leaving directory '/<<PKGBUILDDIR>>/installwatch'
mkdir -p /<<PKGBUILDDIR>>/debian/tmp/usr/bin
mkdir -p /<<PKGBUILDDIR>>/debian/tmp/usr/share/locale

install -m 0755 -o root -g root checkinstall makepak /<<PKGBUILDDIR>>/debian/tmp/usr/bin install: cannot change ownership of '/<<PKGBUILDDIR>>/debian/tmp/usr/bin/checkinstall': Operation not permitted install: cannot change ownership of '/<<PKGBUILDDIR>>/debian/tmp/usr/bin/makepak': Operation not permitted

make[2]: *** [Makefile:31: install] Error 1
make[2]: Leaving directory '/<<PKGBUILDDIR>>'
make[1]: *** [debian/rules:32: override_dh_auto_install] Error 2
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
make: *** [debian/rules:7: binary] Error 2

dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2

--------------------------------------------------------------------------------
Build finished at 2024-11-15T21:35:00Z

-------------------------------------------------------------------------------


The above is just how the build ends and not necessarily the most
relevant part. If required, the full build log is available here:

https://people.debian.org/~nthykier/rrr-no-as-default/logs/977233.gz

You can find common solutions at
https://people.debian.org/~nthykier/rrr-no-as-default/docs/solutions.md

If this is really a bug in one of the build-depends, please use
reassign and affects, so that this is still visible in the BTS web
page for this package.

If this package is listed in
https://people.debian.org/~nthykier/rrr-no-as-default/docs/static-ownership.list,
then please just set `Rules-Requires-Root: binary-targets` to the source
stanza of `debian/control` as a fix to this bug.

If this package is listed in
https://people.debian.org/~nthykier/rrr-no-as-default/docs/maybe-misbuilds.list,
then the package was deemed at risk for misbuilding (having wrong
ownership) but had a FTBFS problem we tested it. Please test whether the
package works with `Rules-Requires-Root: no` validating that the
resulting deb has the correct ownership for all paths in the deb.

The goal is to have the default changed in `dpkg` either in `Trixie` or
`Forky`, depending on progress and feasibility with the release schedule
for Trixie.

For more information on this bug filing, please see:
https://lists.debian.org/debian-dpkg/2024/11/msg00016.html

Thanks,


PS: The builds were performed in mid-November. If you fixed the problem
between between then and this bug being filed, then please just close
the bug with the version it was fixed in.

OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1089300: checkinstall: Supporting rootless builds by default

Reply via email to