--- Begin Message ---
|
Subject: |
make dist tarball contains owner/group information from the build system |
|
Date: |
Fri, 16 Jan 2015 16:07:03 +0100 (CET) |
|
User-agent: |
Alpine 2.10 (DEB 1266 2009-07-14) |
(Please CC me in the replies as I'm not subscribed)
Hello list,
examing the tarballs generated by "make dist" using "tar -tzvvf", it seems
that information about group/owner of the buildsystem is being leaked.
Example output - notice the jenkins/jenkins field:
# tar -tzvvf core/cfengine-3.7.0a1.5ffcc54.tar.gz | head
drwxrwxr-x jenkins/jenkins 0 2015-01-16 02:54:12 cfengine-3.7.0a1.5ffcc54/
-rw-rw-r-- jenkins/jenkins 34036 2015-01-16 02:53:55
cfengine-3.7.0a1.5ffcc54/Makefile.in
-rwxrwxr-x jenkins/jenkins 658314 2015-01-16 02:53:51
cfengine-3.7.0a1.5ffcc54/configure
-rw-rw-r-- jenkins/jenkins 4973 2014-10-27 14:39:26
cfengine-3.7.0a1.5ffcc54/Makefile.am
My workaround is to add the following in Makefile.am:
TAR_OPTIONS = --owner=0 --group=0
export TAR_OPTIONS
I expected that something like this would be the default though.
Thanks,
Dimitris
--- End Message ---
--- Begin Message ---
|
Subject: |
Re: bug#19615: make dist tarball contains owner/group information from the build system |
|
Date: |
Thu, 29 Jun 2023 19:01:11 -0600 |
Hi Dimitrios and all,
Back on this bug from 2015 and earlier (yikes, sorry):
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=19615
TAR_OPTIONS = --owner=0 --group=0
I expected that something like this would be the default though.
I agree it would be desirable, in theory. But we can't make it the
default because it's not portable. It would also be a big change from
existing practice.
I think adding it in projects' Makefile.am is as good as it gets.
Certainly much simpler than trying to determine whether tar supports
--owner/--group at "make dist" time, and then providing options as to
whether to use them or not. Or which options to use. Etc.
Thus, instead of making any change to the code (sorry again), I merely
added a note to the manual about it.
pavel> The fix was promised back in year 2008. I hope we'll see it.
If one of the past or current Automake maintainers has code to deal with
this, I hope they'll say.
http://comments.gmane.org/gmane.comp.sysutils.automake.bugs/4340
404. I didn't try to guess which bug-automake message that might refer to.
bogdan> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60419
... a patch that allows Automake users to provide their own
command-line options that will be passed to the 'tar' utility when
...
- [am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -'],
+ [am__tar='$${TAR-tar} c $${TAR_OPTIONS} -hof - "$$tardir"'
am__untar='$${TAR-tar} x $${UNTAR_OPTIONS} -f -'],
Unfortunately this sort of change is not portable. tar option parsing is
a strange and wonderful area. Non-dash options ("c") can't be mixed with
dash options (-hof). Conceivably we could switch to all dash options
(... -chof - $${TAR_OPTIONS} ...), but Automake currently goes to a lot
of trouble to support even the oldest tars, which don't support dash
options at all. And I'm not sure dash options (with older tars) can be
separated into different groups.
Although such ancient-tar support is probably not important nowadays,
more fundamentally, I don't see anything to be gained. Either GNU tar is
being used, in which case it already supports the TAR_OPTIONS envvar
itself, or it's not, in which case either there are different options or
no options at all for the job, and something different has to be
done. Automake can't solve that problem, as far as I can see. For
instance, trying to chown the unpacked tree before tarring would fail.
This "bug report" can be merged with 19615 or simply deleted.
My attempts to use debbugs to merge the reports failed for no clear
reason. Closing both bugs separately. --thanks, karl.
-----------------------------------------------------------------------------
doc: discuss setting uid/gid information in tarballs.
In response to https://bugs.gnu.org/19615.
* doc/automake.texi (Basics of Distribution): give
example of specifying the TAR_OPTIONS (environment)
variable used by GNU tar.
diff --git a/doc/automake.texi b/doc/automake.texi
index a56e7f8ee..1bf74cd73 100644
--- a/doc/automake.texi
+++ b/doc/automake.texi
@@ -8621,12 +8621,30 @@ More precisely, the gzipped @code{tar} file is named
@c See automake #9822.
@vindex TAR
-You can set the environment variable @code{TAR} to override the tar
-program used; it defaults to @code{tar}. @xref{The Types of
-Distributions}, for how to generate other kinds of archives.
+You can set the environment (or @code{Makefile.am}) variable @code{TAR}
+to override the tar program used; it defaults to @code{tar}.
+@xref{The Types of Distributions}, for how to generate other kinds of
+archives.
-For the most part, the files to distribute are automatically found by
-Automake:
+@vindex TAR_OPTIONS
+With GNU tar, you can also set the environment (or @code{Makefile.am})
+variable @code{TAR_OPTIONS} to pass options to @code{tar}. One common
+case for this is wanting to avoid using the local user's uid and gid
+in the tar file, or the uid being larger than is supported by the tar
+format (not uncommon nowadays). This can be done with, for example>
+
+@example
+TAR_OPTIONS = --owner=0 --group=0
+export TAR_OPTIONS
+@end example
+
+@noindent
+The @code{export} (a GNU make feature) is necessary to pass the
+variable in the environment to the @code{tar} invocation.
+(For more discussion, see @url{https://bugs.gnu.org/19615}.)
+
+For the most part, the files to distribute are automatically
+found by Automake:
@itemize @bullet
@item
@@ -11376,13 +11394,12 @@ time may be overridden: @code{make V=1} will produce
verbose output,
@code{make V=0} less verbose output.
Unfortunately, if @code{V} is assigned a value other than 0 or 1,
-errors will result. This is problematic when a third-party program or
+errors will result. This is problematic when a third-party program or
library is built in the same tree and also uses the make variable
-@code{V}, with different values. The best workaround is probably to
+@code{V}, with different values. The best workaround is probably to
set @code{AM_V_P=true} (or similar), either on the make command line
-or in the @code{V}-using project's @code{Makefile.am}. For more
-discussion:
-@url{https://debbugs.gnu.org/cgi/bugreport.cgi?bug=20077}.
+or in the @code{V}-using project's @code{Makefile.am}. (For more
+discussion, see @url{https://bugs.gnu.org/20077}.)
@end itemize
@cindex default verbosity for silent rules
compile finished at Thu Jun 29 17:59:48 2023
--- End Message ---