Re: [gentoo-portage-dev] [PATCH v3] Copy files/* into the work tree instead of symlinking it

["Michał Górny" <mgorny@gentoo.org>]

On Mon, 2021-09-27 at 12:49 +0200, Ulrich Mueller wrote:
> > > > > > On Sun, 26 Sep 2021, Michał Górny wrote:
> 
> > Symlinking FILESDIR into the work tree has the unintended
> > consequence
> > of preserving all original file metadata, including system-specific
> > ACLs
> > and so on.  When these files are installed, this could lead to
> > unintentionally copying this metadata to the system and/or binary
> > packages.
> 
> > Let's copy all files instead and drop metadata in the process. 
> > Since
> > FILESDIR is expected to be small by design, this shouldn't cause any
> > major trouble.  It is also easier and less likely to cause
> > regressions
> > than making sure stuff is not preserved when installing.
> 
> > Unfortunately, a similar problem applies to DISTDIR.  However,
> > installing files from DISTDIR is rarer than from FILESDIR, so I
> > guess
> > we'll cross that bridge when we get to it.
> 
> Sorry for the late reply, but this looks like the wrong solution to
> me.
> 
> Looking at the installation helpers (doins, doexe, etc.), they don't
> preserve the normal permission bits, but reset them to a defined
> state.
> So why would they preserve xattrs?
> 
> I don't see anything in PMS that would mandate that behaviour (on the
> contrary, in section 13.3.1 there is "Other file attributes may be
> discarded"). How do the other package managers handle this?

Yes, I agree this is the wrong long-term solution but it's a fix that
works today and shouldn't cause regressions.

I'd like to revisit how files are installed long-term but this requires
more time, and most importantly making sure we won't accidentally break
stuff.  I'd like to establish whether we have any ebuilds relying e.g.
on caps or ACLs being preserved from src_install(), and get alternative
solutions to that first (fcaps.eclass-alike?).

Apparently PaX will also require special fixes but I'm not sure if it's
worth fixing at this point.

-- 
Best regards,
Michał Górny