search

dlang / dub

Package and build management system for D
MIT License
673 stars 230 forks source link

Don't try to write to the `--cache=system` cache as an unprivileged user #2651

Closed CyberShadow closed 1 year ago

CyberShadow commented 1 year ago

System information

Reproducible on docker.io/debian:latest with Dub from D 2.103.1

Bug Description

Some context here: https://gist.github.com/ximion/fe6264481319dd94c8308b1ea4e8207a

How to reproduce?

  1. As root, run dub fetch --cache=system foo
  2. As non-root, try to build any package which depends on foo with --cache=system

Full reproducer here: https://gist.github.com/CyberShadow/3dca5becd83f3fef3b582b1a6299a0cc/c6ae623f4e8e9642be02ffaf8e2d0a67ddb4a80f

Expected Behavior

Dub should not try to write to the --cache=system location as an unprivileged user (maybe even if it is a privileged user).

We want to roughly do the same thing Python does with its /usr/lib/python3.10/site-packages, i.e. use them if we can (putting any temporary files in the current directory or $TMPDIR), don't use them if we can't (version mismatch).

AFAIU, fixing this or having something like this in Dub would make packaging Dub packages in Debian much more realistic.

Logs

The reproducer above fails with:

Error /var/lib/dub/packages/emsi_containers-0.9.0/emsi_containers/build: Permission denied
Geod24 commented 1 year ago

I moved most of the generated artifacts to a different location, but there is still one or two things there. I can't remember from the top of my head why they were originally harder to move, but most of the logic should already be there.

The PR that did it: https://github.com/dlang/dub/pull/2542 mentions code is handled, but weirdly I have a different recollection...

CyberShadow commented 1 year ago

OK, I see there is a --temp-build flag which gets it further along, but ultimately it fails with the same error.