`/var/db/repos/gentoo`'s file permissions

[kuraga]

I have an issue on ebuildtester 47 with Podman.
But I think it's common.

There are errors on emerge like:

Messages for package app-alternatives/bzip2-1::gentoo:                                                                                                                                                                                        * ERROR: app-alternatives/bzip2-1::gentoo failed (depend phase):                                                                                                                                                                             *   error sourcing ebuild                                                                                                                                                                                                                   
 *                                                                                                                                                                                                                                           
 * Call stack:                                                                                                                                                                                                                               
 *   ebuild.sh, line 625:  Called die                                                                                                                                                                                                        
 * The specific snippet of code:                                                                                                                                                                                                             
 *                      source "${EBUILD}" || die "error sourcing ebuild"
 * 
 * If you need support, post the output of `emerge --info '=app-alternatives/bzip2-1::gentoo'`,
 * the complete build log and the output of `emerge -pqv '=app-alternatives/bzip2-1::gentoo'`.
 * Working directory: '/usr/lib/python3.13/site-packages'
 * S: '/var/tmp/portage/app-alternatives/bzip2-1/work/bzip2-1'
 |/usr/lib/portage/python3.13/ebuild.sh: line 625: /var/db/repos/gentoo/net-misc/openssh/openssh-10.0_p1.ebuild: Permission denied

My investigation is below.

The {local_portage} directory is owned by host-group:host-user on the host, and is /var/db/repos/gentoo and owned by container-root:container-root in the container, by default.
Let's write this as {local_portage} (group:user) ~ /var/db/repos/gentoo (root:root).
This allows to create {local_portage}/packages (group:user) ~ /var/db/repos/gentoo/packages (root:root) and {local_portage}/distfiles (group:user) ~ /var/db/repos/gentoo/distfiles (root:root), see #229.

So, {local_portage}/**/* (group:user) ~ /var/db/repos/gentoo/**/* (root:root).
But emerge waits for ... ~ /var/db/repos/gentoo/**/* (portage:portage)!

[stkw0]

Thank you very much! Please, keep reporting any users related with podman.

About this particular issue, I was aware of that, I think the proper solution is to have packages ad distfiles to be placed under ~/.local/share/ebuildtester, as a fallback if the PKGDIR and DISTDIR configured in /etc/portage/make.conf don't have the proper permissions.

That's the reason why I didn't closed the issue about libpodman and just referenced it.

[kuraga]

I don't know which is the right solution (but this is the most important :)).
(But I'm still sure it should not depend on the container toolkit.)

https://wiki.gentoo.org/wiki/Handbook:AMD64/Portage/CustomTree#Creating_a_custom_ebuild_repository says to chown -R portage:portage.

We can chown (inside the container), too. But we have to eliminate both points:

• the Portage's requirements,
• creating directories via --volume.

[kuraga]

I think the proper solution is to have packages ad distfiles to be placed under ~/.local/share/ebuildtester, as a fallback if the PKGDIR and DISTDIR configured in /etc/portage/make.conf don't have the proper permissions.

Oh, now I see another good point here:

ebuildtester/ebuildtester/docker.py

Lines 170 to 172 in bbf943b

	"--volume", "%s:/var/db/repos/gentoo" % local_portage,
	"--volume", "%s:/var/cache/distfiles" % distdir,
	"--volume", "%s:/var/cache/binpkgs" % pkgdir]

We could volume the first as read--only!
It's a good practice to not pollute the input.

[stkw0]

I think there was some issue/PR to add an option to update the Manifest automatically. That would be incompatible with making the volume unconditionally read-only. Also, some people could edit the ebuilds from the container directly.

Maybe it can be done in a way that if --batch is used, it mounts PORTDIR as ro¿?

[kuraga]

Then we should add a note on the {local_portage} modifying to the help/documentation.

[kuraga]

Also there is an idea to copy the local portage/etc. contents (with correct permissions/etc.).
This eliminates all (my) questions.

[kuraga]

Concerned with: #245 (comment).

[stkw0]

Given that the problem seems to be the stricter umask on your system, for now I think the best approach is to use umask 0022 for the Gentoo repository and any overlays.

There are some incompatibilities between docker and podman that would require to change the philosophy of ebuildtester.
It's even worst given that there is no good way to check if a container would have access to a given volume.

[kuraga]

Ok, then I propose to document something like

The read access for others on the portage and overlay directories is up to you, user.
Because emerge uses portage:portage which is absence in the container.

(and maybe else).

And, there is a workaround to add the --docker-arguments argument?
(For Padman users, here.)

[stkw0]

You can already use --docker-comand and use a custom bash script which adds any options and arguments you may want. But it may be cleaner by adding a new option.

I would play a little bit more, maybe we could add a paragraph showing different workarounds