Bug#845715: Required targets must not write outside of the source package tree
On Sun, Nov 11, 2018 at 11:25:58AM -0700, Sean Whitton wrote:
> Hello,
>
> === Addressing the participants in this thread more generally,
> especially those who seconded my most recent patch: ===
>
> Bill has raised several scenarios in which this new requirement could be
> interpreted as making a package RC-buggy, where that might be considered
> unreasonable. Building in wording to avoid each of the cases would make
> the whole patch a lot more complex, but it could be done.
>
> An alternative would be for us to weaken the main requirement of the
> patch from 'must' to 'should'. That way, this patch would not be in the
> business of making any packages RC-buggy. I don't think Bill thinks his
> cases are not bugs, just that they are not of RC severity.
More accurately: I am not sure the Debian archive is ready for these
bugs to be RC, especially since they are usually upstream bugs.
I can be convinced otherwise with data, though.
Other corner cases are /var/tmp and builds leading to files in /run or
/var to be created or modified.
Package support for TMPDIR can be introduced as a general requirement,
outside of the build process.
> Concerns about (2): it seems to me that this would not reflect the
> project's consensus that source package builds really should not be
> writing to places outside of TMPDIR and their own trees, aside from the
> final generated binary packages.
Note that you used "should" :)
Maybe the proposal could be rewritten in a way that does not need to
cover the detail of temporaries files.
How about:
+Required targets must not attempt to write outside of the unpacked
+source package tree. There are two exceptions. Firstly, the binary
+targets may write the binary packages to the parent directory of the
+unpacked source package tree. Secondly, required targets may write to
+/tmp, /var/tmp and to the directory specified by the ``TMPDIR`` environment
+ variable, but must not depend on the content of either.
+
+This restriction is intended to prevent source package builds creating
+and depending on state outside of themselves, thus affecting multiple
+independent rebuilds. In particular, the required targets must not
+attempt to write into ``HOME``.
As far as RC bug are concerned, Policy need to reflect current practice
before the Project's consensus. If a change causes a lot of packages to
be RC buggy, then there is a need for a transition period during which
the bug is not RC and the maintainers are notified of the bugs and given
the opportunity to fix them. The alternative is that the policy
requirement is ignored.
Cheers,
--
Bill. <ballombe@debian.org>
Imagine a large red swirl here.
Reply to: