Your message dated Mon, 02 May 2016 04:19:41 +0000
with message-id <[email protected]>
and subject line Bug#804624: fixed in dpkg 1.18.5
has caused the Debian Bug report #804624,
regarding please improve support for installing foreign packages to chroots and
add DPKG_ROOT
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
804624: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804624
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: dpkg
Version: 1.18.3
Severity: wishlist
Tags: patch
User: [email protected]
Usertags: rebootstrap
Hi Guillem,
Thank you very much for discussing the idea of DPKG_ROOT and recording
some results at https://wiki.debian.org/Teams/Dpkg/Spec/InstallBootstrap
already. By now, I am convinced that this idea is worth exploring and
have thus prepared a small patch set implementing some of the first
steps.
a) dpkg should export DPKG_ROOT. DPKG_ROOT should be a string that
should be prepended to "/" to arrive at the current installation
root (instdir). Notably, when dpkg invokes chroot(), DPKG_ROOT
becomes empty. At the moment, DPKG_ROOT is always empty, but this
should not be relied upon. This is
0001-export-a-variable-DPKG_ROOT.patch.
b) Packages that do not "set -u" (nounset), can now prepend $DPKG_ROOT
to any file they operate on. With old versions $DPKG_ROOT will be
unset and with change a) $DPKG_ROOT will be empty. Thus this change
is backwards-compatible.
c) dpkg should gain a new force flag. I call it --force-remote-configure
for now. It is supposed to force dpkg into running maintainer scripts
without chroot even when the package in question did not declare that
its maintainer scripts support this mode of operation. Note that we
currently have no way to express whether a package supports running
maintainer scripts without chroot. The flag is being added by
0002-add-force-remote-scripts.patch and the behavior is implemented
by 0003-inhibit-chroot-when-force-remote-scripts.patch. Packages can
only reasonably support this mode after implementing b).
d) Once a) is accepted and b) starts getting implemented, we need to
think about a way for packages to tell that they support "remote
scripts". One way to do so would be to add a header "Remote-Scripts:
yes" to the binary package stanza. Packages thus marked would be
required to honour DPKG_ROOT in all maintainer scripts. This flag
makes no provisions yet on what programs can be assumed to be
installed outside the chroot that is operated on.
e) Once a) is accepted and b) starts getting implemented, we need to
think about what programs maintainer scripts can assume to be
available outside the chroot. Some ways to handle that:
* Packages may only assume "common unix functionality". Such a set
would have to be defined somehow and roughly equates what
debootstrap requires.
* Packages may only assume essential packages to be available.
* A new set of headers Maint-{Depends,Conflicts,...} is added to
request tools to be installed. These new relations would be
checked outside the chroot (if any).
A full Debian release or two needs to pass before such headers can
be used in the archive. This also poses the problem that a user
can remove packages required for removing other packages and thus
revoking the ability to remove certain packages. It is not clear
how the absence of Maint-Depends is supposed to be handled. It is
not clear whether dpkg needs to lock the dpkg database outside the
chroot.
f) Once a), b) and d) are implemented and some version of e) is agreed
upon, debootstrap can be changed to prefer configuring packages that
support "remote scripts" to break dependency cycles.
g) At the same time as f), tools like multistrap can start making use of
this new functionality.
With the above patches, I verified that I can install a package with a
maintainer script into a chroot that has an empty database (in
particular no essential package is unpacked in the chroot). The
maintainer script is run without chroot and has DPKG_ROOT set up
properly.
bash's preinst will become a problem with this scheme. It is a binary
due to earlier breakage when it was a script, but the "remote scripts"
approach cannot work with binaries, because we cannot know whether the
cpu supports executing such binaries. I don't have a plan for
bash.preinst.
I understand that what I propose herein is a steep change with wide
ranging implications. It needs sincere thought to avoid creating a
situation that is hard to fix up. Yet it seems pretty round to me
already. Despite there being open questions, we can handle at least a)
today.
Helmut
>From b10ba1186394ae880a5c1421ddb07afa1f3c9d20 Mon Sep 17 00:00:00 2001
From: Helmut Grohne <[email protected]>
Date: Mon, 9 Nov 2015 22:07:52 +0100
Subject: [PATCH 1/3] export a variable DPKG_ROOT
This variable holds the value of instdir. It is supposed to be used in
maintainer scripts. It should be prepended to all paths that are
operated on. Currently, dpkg chroots to the instdir before invoking
maintainer scripts, so when it does that DPKG_ROOT is set to the empty
string. Thus currently, DPKG_ROOT is always empty.
---
src/main.c | 2 ++
src/script.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/src/main.c b/src/main.c
index f16dc0a..4ac701c 100644
--- a/src/main.c
+++ b/src/main.c
@@ -885,6 +885,8 @@ int main(int argc, const char *const *argv) {
/* Always set environment, to avoid possible security risks. */
if (setenv("DPKG_ADMINDIR", admindir, 1) < 0)
ohshite(_("unable to setenv for subprocesses"));
+ if (setenv("DPKG_ROOT", instdir, 1) < 0)
+ ohshite(_("unable to setenv for subprocesses"));
if (!f_triggers)
f_triggers = (cipaction->arg_int == act_triggers && *argv) ? -1 : 1;
diff --git a/src/script.c b/src/script.c
index a958145..ac79444 100644
--- a/src/script.c
+++ b/src/script.c
@@ -104,6 +104,8 @@ maintscript_pre_exec(struct command *cmd)
ohshit(_("admindir must be inside instdir for dpkg to work properly"));
if (setenv("DPKG_ADMINDIR", admindir + instdirl, 1) < 0)
ohshite(_("unable to setenv for subprocesses"));
+ if (setenv("DPKG_ROOT", "", 1) < 0)
+ ohshite(_("unable to setenv for subprocesses"));
if (chroot(instdir))
ohshite(_("failed to chroot to '%.250s'"), instdir);
--
2.4.6
>From 8b7ef663a42b2f88fb91c5e72006362b30d33f85 Mon Sep 17 00:00:00 2001
From: Helmut Grohne <[email protected]>
Date: Mon, 9 Nov 2015 22:16:10 +0100
Subject: [PATCH 2/3] add --force-remote-scripts
Currently, dpkg chroots to the instdir before invoking maintainer
scripts. The new force flag is supposed to inhibit the chroot call. The
user is supposed to know that the packages he is operating on do support
this new mode of operation. Thus the force flag is marked as dangerous.
---
src/main.c | 3 +++
src/main.h | 1 +
2 files changed, 4 insertions(+)
diff --git a/src/main.c b/src/main.c
index 4ac701c..9dd5308 100644
--- a/src/main.c
+++ b/src/main.c
@@ -196,6 +196,7 @@ int fc_conff_ask = 0;
int fc_unsafe_io = 0;
int fc_badverify = 0;
int fc_badversion = 0;
+int fc_remote_scripts = 0;
int errabort = 50;
static const char *admindir = ADMINDIR;
@@ -275,6 +276,8 @@ static const struct forceinfo {
'!', N_("Remove packages which require installation") },
{ "remove-essential", &fc_removeessential,
'!', N_("Remove an essential package") },
+ { "remote-scripts", &fc_remote_scripts,
+ '!', N_("Allow running maintainer scripts remotely") },
{ NULL }
};
diff --git a/src/main.h b/src/main.h
index c85c2cb..73a13cb 100644
--- a/src/main.h
+++ b/src/main.h
@@ -142,6 +142,7 @@ extern int fc_conff_ask;
extern int fc_badverify;
extern int fc_badversion;
extern int fc_unsafe_io;
+extern int fc_remote_scripts;
extern bool abort_processing;
extern int errabort;
--
2.4.6
>From 2a0d657eded51651a8aec658a4c84a607ad51988 Mon Sep 17 00:00:00 2001
From: Helmut Grohne <[email protected]>
Date: Mon, 9 Nov 2015 22:20:57 +0100
Subject: [PATCH 3/3] inhibit chroot when --force-remote-scripts
---
src/script.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/script.c b/src/script.c
index ac79444..00075b9 100644
--- a/src/script.c
+++ b/src/script.c
@@ -99,7 +99,7 @@ maintscript_pre_exec(struct command *cmd)
const char *admindir = dpkg_db_get_dir();
size_t instdirl = strlen(instdir);
- if (*instdir) {
+ if (*instdir && !fc_remote_scripts) {
if (strncmp(admindir, instdir, instdirl) != 0)
ohshit(_("admindir must be inside instdir for dpkg to work properly"));
if (setenv("DPKG_ADMINDIR", admindir + instdirl, 1) < 0)
@@ -112,8 +112,8 @@ maintscript_pre_exec(struct command *cmd)
}
/* Switch to a known good directory to give the maintainer script
* a saner environment, also needed after the chroot(). */
- if (chdir("/"))
- ohshite(_("failed to chdir to '%.255s'"), "/");
+ if (chdir(fc_remote_scripts ? instdir : "/"))
+ ohshite(_("failed to chdir to '%.255s'"), fc_remote_scripts ? instdir : "/");
if (debug_has_flag(dbg_scripts)) {
struct varbuf args = VARBUF_INIT;
const char **argv = cmd->argv;
@@ -127,7 +127,7 @@ maintscript_pre_exec(struct command *cmd)
args.buf);
varbuf_destroy(&args);
}
- if (!instdirl)
+ if (fc_remote_scripts || !instdirl)
return cmd->filename;
assert(strlen(cmd->filename) >= instdirl);
--
2.4.6
--- End Message ---
--- Begin Message ---
Source: dpkg
Source-Version: 1.18.5
We believe that the bug you reported is fixed in the latest version of
dpkg, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Guillem Jover <[email protected]> (supplier of updated dpkg package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 02 May 2016 04:14:57 +0200
Source: dpkg
Binary: libdpkg-dev dpkg dpkg-dev libdpkg-perl dselect
Architecture: source
Version: 1.18.5
Distribution: unstable
Urgency: medium
Maintainer: Dpkg Developers <[email protected]>
Changed-By: Guillem Jover <[email protected]>
Description:
dpkg - Debian package management system
dpkg-dev - Debian package development tools
dselect - Debian package management front-end
libdpkg-dev - Debian package management static library
libdpkg-perl - Dpkg perl modules
Closes: 719845 780906 784806 784808 795163 804624 807340 809174 809219 809517
809963 810720 811037 811267 812679 813179 819194 819939 819940 821025 822797
822798
Changes:
dpkg (1.18.5) unstable; urgency=medium
.
[ Guillem Jover ]
* Print correct integer parse error for short-only command-line options.
This affects «dpkg-deb -z». Closes: #809174
* Do not abort when traversing symlinks to directories in dpkg-scanpackages
and dpkg-scansources. Closes: #809219
* Implement delete operator with size argument in dselect, required by the
C++14 spec when the size-less delete operator is defined.
* Use EACCES instead of EWOULDBLOCK for fcntl(2) F_SETLK in dselect.
* Print the archive filename when dpkg cannot access it.
* Check that all passed archive filenames to dpkg exist before queuing them.
Closes: #809963
* Use ohshit() instead of internerr() for unhandled dpkg-split exit codes.
(i.e. do not abort). Closes: #812679
* Detect non-regular file archive arguments earlier in dpkg.
* Switch URLs in docs, code comments and packaging, from http:// or git://
to https:// if the latter is available (round three). This includes the
dpkg git repository, copyright format URL and examples in man pages among
others.
* Clarify where to find the GPL-2 license in debian/copyright.
* Do not enable stack-protector on nios2 in Debian and derivatives (it is
not supported by gcc yet).
* Check first for build type to short-circuit boolean expressions in
dpkg-genchanges.
* Add source format backend-specific --help options support to dpkg-source.
* Add MIPS R6 architectures to arch tables. Closes: #807340
Thanks to YunQiang Su <[email protected]>.
* Fix memory leak when unpacking conffiles.
* Use fixed string matching for pathnames in dpkg-maintscript-helper.
Thanks to Carsten Hey <[email protected]>.
* Quote shell variables in dpkg-maintscript-helper.
Thanks to Carsten Hey <[email protected]>.
* Anchor pathnames in sed and grep regexes in dpkg-maintscript-helper.
Thanks to Carsten Hey <[email protected]>.
* Allow broken versions starting with a dash in dpkg-maintscript-helper.
Thanks to Carsten Hey <[email protected]>.
* Add a new treewalk module in libdpkg, with the nice properties of avoiding
duplicate stat(2) calls, not calling find(1), and sorting the output w/o
stalling on the entire input being slurped and sorted.
- Use it to build the .deb data member in dpkg-deb.
- Use it to build the .deb control member in dpkg-deb.
Closes: #719845
- Use it with dpkg --recursive option.
* Unify start-stop-daemon --help output with the rest of the tools.
* Search for debsig-verify in PATH instead of using an absolute path.
* Do not error out when failing to open the SE label db on permissive mode.
Closes: #811037
* Rewrite the trigger deferred file parser from flex to manual. The format
is very simple, and a simple hand-written parser is smaller and avoids a
build dependency.
* Be more strict when parsing the COLUMNS environment variable in dpkg-query.
* Make the Architecture field mandatory on package builds.
* Use new Dpkg::Arch functions to validate and parse architectures when
building source packages. Closes: #784808
* Do safe matching of directories containing conffiles in
dpkg-maintscript-helper, instead of using a variable pathname as a regex
with grep, which is susceptible to metacharacters acting as part of the
regex. Proposed by Carsten Hey <[email protected]>.
* Decouple local keyword declaration from command assignment in
dpkg-maintscript-helper, which masks the command return value when
using «set -e».
* Make dpkg pass <new-version> to maintscript actions that cannot get it
otherwise. These actions are now:
- <new-postrm> failed-upgrade <old-version> <new-version>
- <new-postrm> abort-install <old-version> <new-version>
- <new-postrm> abort-upgrade <old-version> <new-version>
- <new-preinst> install <old-version> <new-version>
- <new-preinst> upgrade <old-version> <new-version>
- <new-prerm> failed-upgrade <old-version> <new-version>
Prompted by Andrey Utkin <[email protected]>.
* Promote a print to a warning for missing control files in dpkg-deb.
* Use info() instead of print in dpkg-buildpackage and dpkg-genchanges.
* Add very basic color support to all dpkg namespaced programs, enabled by
setting the environment variable DPKG_COLORS to “auto”, “always” or
“never”, the latter being the default.
* Add support for a new --build option to define build type by a
comma-separated list of components (“source”, “any”, “all”, “binary” or
“full”) in dpkg-genchanges and dpkg-buildpackage.
* Add new -I option to dpkg-shlibdeps to ignore package build directories.
Closes: #821025
* Add new -O option to dpkg-genchanges.
* Make dpkg export variable DPKG_ROOT in maintainer scripts. Closes: #804624
Thanks to Helmut Grohne <[email protected]>.
* Add new --force-script-chrootless option to dpkg.
Thanks to Helmut Grohne <[email protected]>.
* Portability:
- Move DPKG_ADMINDIR environment variable name out from update-alternatives
code, to make life easier for non-dpkg-based systems.
- Move alternatives temporary extension out from update-alternatives code,
to make life easier for non-dpkg-based systems.
- Switch start-stop-daemon on */kFreeBSD to use the low-level sysctl(3)
interface instead of libkvm-dev.
* Perl modules:
- Add new CTRL_REPO_RELEASE control block type to Dpkg::Control.
- Add new CTRL_COPYRIGHT_HEADER, CTRL_COPYRIGHT_FILES and
CTRL_COPYRIGHT_LICENSE control block types to Dpkg::Control.
- Make patching a file multiple times fatal for the first quilt patch in
Dpkg::Source. Reported by Apollon Oikonomopoulos <[email protected]>.
Closes: #810720
- Only warn once when a diff patches a file multiple times in
Dpkg::Source::Patch, and fix the warning message to make it clear that
the diff might be patching the file more than once, not just twice.
- Check existence of search criteria in Dpkg::Index when checking with a
regex or a string match. Closes: #780906
Base on a patch by Daniel Dehennin <[email protected]>.
- Add new functions to validate and parse architecture names in Dpkg::Arch.
- Make the dependency parser more strict in Dpkg::Deps. Closes: #784806
- Add strong digest marking support to Dpkg::Checksums.
- Error out on source packages without any strong digests in
Dpkg::Source::Package, used by dpkg-source --extract, which can still
be disabled with --no-check.
- Switch Dpkg::Conf implementation to be hash based, add two new accessors
and a new option to the filter method to use the old behavior.
- Do not parse entry multiple times in Dpkg::Changelog::Entry::Debian.
Add new parse_header() and parse_trailer() methods, and deprecate
check_header() and check_trailer() ones.
- Use “GnuPG” instead of “gpg” in error messages to refer to the software
in Dpkg::Source::Package.
- Handle undef versions in Dpkg::Changelog from empty versions in
changelog entry header lines.
- Allow detached upstream orig tarball signatures when extracting
version 1.0 non-native source packages.
- Include upstream orig tarball signatures in source packages.
See #759478.
- Add fixdebugpath to reproducible feature in Dpkg::Vendor::Debian.
Thanks to Daniel Kahn Gillmor <[email protected]>. Closes: #819194
* Build system:
- Fix building development documentation.
- Remove unused UA_LIBS variable.
- Split libps and libkvm detection into their own macros and variables.
- Make it possible to build without system libmd.
- Add a configuration summary to configure output.
- Make git log invocation immune to local configuration.
- Do not require passing the perl interpreter to run-script.
- Quote dirname argument in run-script, to handle spaces in pathname.
Reported by Carsten Hey <[email protected]>.
- Use a single po4a opt argument instead of the same per language.
* Packaging:
- Enable all hardening flags, starting with gcc-5 there is no performance
loss anymore when enabling PIE on i386.
* Test suite:
- Add a unit test to compile perl code with warnings.
- Add a unit test for the trigger deferred parser.
* Documentation:
- Say value instead of option in deb-control(5).
- Mark debian changelog format in bold in dpkg-parsechangelog(1).
- Add references to man pages describing file formats.
- Document missing Install-Size, Built-For-Profiles and Build-Profiles
fields in man pages.
- Add new dsc(5), deb-changelog(5) and deb-changes(5) man pages.
- Remove Debian specific policy references.
- Remove superfluous SEE ALSO references from dpkg-source(1).
- Fix --remove and --purge summary formatting in dpkg(1).
- Move --audit description just after --verify in dpkg(1).
- Mark Maintainer field as bold in deb-src-control(5).
- Fix reference to --record-avail instead of nonexistent --avail.
- Add missing quotes in man pages.
- Document Source field version in deb-control(5).
- Add new deb822(5) man page.
- Document and improve C/C++ programs exit codes in man pages.
- Clarify dpkg --path-exclude/--path-include pathname filter behavior.
Closes: #811267
- Clarify that packages are only automatically forgotten by dpkg if they
contain no user data, such as package selections. Closes: #813179
- Fix documentation for package flags in dpkg(1).
- Clarify that deb-symbols(5) documents the binary format subset, and
the template symbol files are described in dpkg-gensymbols(1).
Closes: #795163
- Update field requirements of control file formats to match dpkg reality.
- Document the format of the origins filename in deb-origin(5).
- Add list of flags set by bug feature area to dpkg-buildflags(1).
- Switch output encoding of man pages to UTF-8.
- Move SEE ALSO section to the end of Dpkg::Changelog::Debian.
- Clarify that i386 does not suffer performance loss due to PIE anymore
since gcc >= 5 in dpkg-buildflags(1).
- Document in deb822(5) that deb-origin(5) also supports comments.
- Clarify which characters constitute the deb822(5) control files syntax
by using Unicode code points and their printable characters.
Based on a patch by Ben Finney <[email protected]>.
- Remove wrong mention that deb-control(5) support comments.
- Make explicit that deb-control(5) documents the binary control file.
- Add missing value for Standards-Version field in dsc(5).
Reported by Helge Kreutzmann <[email protected]>.
.
[ Updated programs translations ]
* Dutch (Frans Spiesschaert). Closes: #822797
* German (Sven Joachim).
* Japanese (Takuma Yamada). Closes: #819939
* Portuguese (Miguel Figueiredo).
* Simplified Chinese (Zhou Mo). Closes: #809517
* Vietnamese (Trần Ngọc Quân).
.
[ Updated dselect translations ]
* Japanese (Takuma Yamada). Closes: #819940
.
[ Updated scripts translations ]
* German (Helge Kreutzmann).
.
[ New manpages translations ]
* Dutch (Frans Spiesschaert). Closes: #822798
.
[ Updated manpages translations ]
* German (Helge Kreutzmann).
Checksums-Sha1:
260978c36020a0cf3ea5a3e6ef2d56e6943d10eb 2026 dpkg_1.18.5.dsc
706adb4b7bdbd195d71d0fc1f9864434b6e869f0 4616552 dpkg_1.18.5.tar.xz
Checksums-Sha256:
3545dff3478c04ddc4c90901df48df81c9b72872f81d5fb36c45dce1a7d442d9 2026
dpkg_1.18.5.dsc
074e6a66a1e7a4b14ec3aa1d198be565acff3e067595fd42bb4dec4d14468b07 4616552
dpkg_1.18.5.tar.xz
Files:
5b2f82bd2cef925f99850703dea57630 2026 admin required dpkg_1.18.5.dsc
43370c852daf8bcdcdfcc34b5dde22f1 4616552 admin required dpkg_1.18.5.tar.xz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJXJslWAAoJELlyvz6krlejMeAQAJoUKwWdMX2YWQpU93CE08vn
BZ3Xl9TcT3vK1az1nrQFMFs0Boxe43c0W7lMdyIYqrc+CbgDNkPBZCnRxO8R+xOa
ue7h6d3EIcGtq+qe8iP2RidnQwfNldzZfb0WmV/lmpECn4FL0xAbnF4+euCQjrsR
WvP7HFNWpcLGwrNM7t4ATbkFSKqCgRQS5yy9bA4b6nFavjXq4Y4FyhsQwu9e3u37
8a4ulasK0CSkJofQ/U7crgpjzHLXjciFcrWfC4Mx9c2dgbvOcvCF5dbjam+1/rsl
gDhNXEG35tlbXtCeDBu/qefontrK6ZS7l2sEmWoNVoZYtdewjJQzZuhtabTcJRo8
nTnJ8mD3oZVNaeKP+csQz1cMAC289hmleX8A0A8vts4fH+HfFZ6/mZf3gbsEc062
VfXXIl9bsPVneljcR2g0PUaPYzHArVfzKywt4ZeEcJgUso/GqySQiA7Fh9xl7BOL
AkKTpNhtM0Tl/nFOIbX1zShCPKcNSEx9YpkzxWFHvLCT9GNWx0eAZHJrw9w7O3lj
tHAAxdxC0vjOpk2Pv0J4t42JCNr0xjrzNdZn7g8tkahYRgGMbHrGDiIH7UmJTDuJ
OYsEB75cSc1QwdqtdtRYYmOxAGVjrfYF1q/DWO7wOmWDGu1Nti/PUkYacG9gEP6z
+jFM/DTpf7Bv7hwRTQyq
=L/BK
-----END PGP SIGNATURE-----
--- End Message ---
