Re: [Rpm-maint] [rpm-software-management/rpm] RFE: support isolation between %prep/%build/%install/%check (Issue #3050)

2024-04-19 Thread Panu Matilainen
Yup. Note "ideally" in there - this is stuff to explore with, and indeed for 
packaging hygiene reasons rather than any "security" thing.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3050#issuecomment-2065908096
You are receiving this because you are subscribed to this thread.

Message ID: ___
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint


Re: [Rpm-maint] [rpm-software-management/rpm] RFE: support isolation between %prep/%build/%install/%check (Issue #3050)

2024-04-19 Thread Zbigniew Jędrzejewski-Szmek
> %install should run with a read-only build directory

I don't think this is going to work. E.g. autotoolz-based systems (something in 
the autotools, automake, libconf stack) do final preparation steps in the 
install target. I think this is inelegant, but not really "wrong". Old meson 
versions had a buglet in the i18n module where the po file would be generated 
not during build but during installation. But more widely, tools write 
installation logs into the build directory. Meson does, I think various Python 
tools do (pip?), etc. Anything that gives an "uninstall" command needs to put 
the information somewhere.

> %check should run with read-only buildroot to prevent tests from affecting 
> packaged content.

People were asking about this a lot in #3010. My motivation for this: build 
hygiene and reproducibility. The `%check` section is optional and can be 
skipped with `--nocheck` or `--without tests`. The result of a build that 
skipped checks should be identical, which would break if anything in `%check` 
touches `%{buildroot}`. If `%{buildroot}` is made readonly, we know that we can 
skip checks safely and save time. For example, when doing build reproducibility 
checks, I'd skip tests, because we're not interested in their result at all, 
but we can do that safely only if we are sure that they don't influence package 
contents.

> It probably does need writable build-dir because those tests do need to write 
> someplace

And same with install: I have seen various sources generate stuff needed for 
tests in check targets, not build. In summary, I think that in practice all 
phases must be given write access to the build directory.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3050#issuecomment-2065876550
You are receiving this because you are subscribed to this thread.

Message ID: ___
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint


[Rpm-maint] [rpm-software-management/rpm] RFE: support isolation between %prep/%build/%install/%check (Issue #3050)

2024-04-19 Thread Panu Matilainen
Ideally, the build scriptlets would be isolated from each other:
- %prep unpacks the source, and  %build takes place in a separate directory 
against a read-only source. Obviously not all software can be built outside the 
source tree, but this would be a nice addon to vpath builds (#2985)
- %install wipes buildroot on start, so %build cannot accidentally install 
stuff. But ideally %install should run with a read-only build directory - 
install should install, not build. This would've caught #3024. 
- %check should run with read-only buildroot to prevent tests from affecting 
packaged content. It probably does need writable build-dir because those tests 
do need to write someplace.


-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/3050
You are receiving this because you are subscribed to this thread.

Message ID: ___
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint