On Wed, 2007-02-14 at 14:08 -0500, Jesse Keating wrote:
> On Wednesday 14 February 2007 12:55, Matthias Saou wrote:
> > Why pick _one_ when it's trivial to evaluate the level of safety a given
> > buildroot has for the Fedora build system? That extra "id" execution is
> > totally useless with mock, and I simply dislike adding useless stuff.
> > Any useless stuff, anywhere.
> >
> > %{_tmppath}/%{name}-%{version}-%{release}-root
> >
> > Is shorter than what is now _mandatory_, just as safe/unsafe with mock,
> > which is what we encourage all users to use for builds anyway. And it
> > saves that useless "id" execution.
>
> Given that mock is a clean root each time, just %{_tmppath}/%{name} is
> enough. However this rule isn't for use in mock, this rule was brought up
> and contested for uses outside of mock, particularly by Ralf Corsepius.
For the record:
My issue is: IMO, the default settings rpmbuild uses, must be safe
against arbitrary users running rpmbuild in a multi user environment.
%{_tmppath}/%{name}-%{version}-%{release}
does not suffice this criterion.
It fails in a multiuser environment when rpmbuild leave behind
%rpmbuild,
e.g.:
su -l user1
rpmbuild -ba xxxx.spec
<rpmbuild fails, files remain in %buildroot>
...
su -l user2
rpmbuild -ba xxxx.spec
<rpmbuild fails, because files in %buildroot are owned by user1>
This situation typically happens in situations, when co-workers share a
machine but work on the same project or a user is using several accounts
on the same machine.
%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
suffices this criterion.
> > If a mktemp based buildroot which actually fixes real issues is found,
> > I'll have absolutely no problem switching to that!
>
> Ralf should be able to point out these problems which a mktemp based solution
> would fix.
c.f. above.
Unfortunately, AFAICT, certain types of rpmbuild invocations seem to
invoke executables contained in %buildroot several times. i.e. any
command returning different values in subsequent invocations durning
rpmbuild-runs will not be applicable (mktemp, timestamps etc.)
Ralf
--
fedora-extras-list mailing list
fedora-extras-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-extras-list
