testing ports as unpriviledged user

[hulten]

When I test a port, following the guide, I get stuck on extract, or actually the prepare target. I guess the problem is that I don't have the priviledges. I am doing this as a normal user with PORTS_PRIVSEP setup. This appears to work: I can

make && doas make install

without a problem. But I think that the prepare target needs to install dependencies, for which root access is needed but of course 'make extract' does not insert a 'doas ' in front of any 'make install' it needs to do.

I am uncertain, if only that when testing a package it needs to install dependencies (already in one of the first steps in the testing guide).

I may be wrong, in which case I need to clarify with terminal output:

.../print/luametatex$ make extract
[...]
===>  Building package for ninja-1.11.1p0v0
Create /usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz
Creating package ninja-1.11.1p0v0
Link to /usr/ports/packages/amd64/ftp/ninja-1.11.1p0v0.tgz
===>  Cleaning for ninja-1.11.1p0v0
===> Building from scratch ninja-1.11.1p0v0
===> ninja-1.11.1p0v0 depends on: re2c-* -> re2c-3.1
===> ninja-1.11.1p0v0 depends on: python->=3.11,<3.12 -> python-3.11.10p1
===>  Verifying specs: c m c++ c++abi pthread
===>  found c.100.3 m.10.1 c++.10.0 c++abi.7.0 pthread.27.1
===>  Installing ninja-1.11.1p0v0 from /usr/ports/packages/amd64/all/
quirks-7.69 signed on 2024-11-16T21:00:07Z
file:/usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz: unsigned package
Can't find /usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz
Couldn't install ninja-1.11.1p0v0
*** Error 1 in /usr/ports/devel/ninja (/usr/ports/infrastructure/mk/bsd.port.mk:2260 '/var/db/pkg/ninja-1.11.1p0v0/+CONTENTS': @/usr/bin/env...)
*** Error 2 in /usr/ports/devel/ninja (/usr/ports/infrastructure/mk/bsd.port.mk:2704 'install': @lock=ninja-1.11.1p0v0;  export _LOCKS_HELD=...)
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2386 '/usr/ports/pobj/luametatex-2.11.01/.dep-devel-ninja': @unset _DEPENDS_TARGE...)
*** Error 2 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2796 '/usr/ports/pobj/luametatex-2.11.01/.extract_done': @cd /usr/ports/mystuff/p...)
*** Error 2 in /usr/ports/mystuff/print/luametatex (/usr/ports/infrastructure/mk/bsd.port.mk:2704 'extract': @lock=luametatex-2.11.01;  expo...)

[hulten]

Though my goal is to test a package submitted to ports@ and finally submit my own port, the problem is much more basic/early (in the learning process).

I cannot build a package that is in ports:

$ pwd                                            
/usr/ports/print/luametatex                                                           
$ make all
===> luametatex-2.10.08p0 depends on: ninja-* - not found                             
===>  Verifying install for ninja-* in devel/ninja                    
`/usr/ports/bulk/amd64/ninja-1.11.1p0v0' is up to date.                               
===>  Installing ninja-1.11.1p0v0 from /usr/ports/packages/amd64/all/
quirks-7.69 signed on 2024-11-16T21:00:07Z                                            
file:/usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz: unsigned package
Can't find /usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz                         
Couldn't install ninja-1.11.1p0v0
*** Error 1 in /usr/ports/devel/ninja (/usr/ports/infrastructure/mk/bsd.port.mk:2260 '/var/db/pkg/ninja-1.11.1p0v0/+CONTENTS': @/usr/bin/env...)
*** Error 2 in /usr/ports/devel/ninja (/usr/ports/infrastructure/mk/bsd.port.mk:2704 'install': @lock=ninja-1.11.1p0v0;  export _LOCKS_HELD=...)
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2386 '/usr/ports/pobj/luametatex-2.10.08/.dep-devel-ninja': @unset _DEPENDS_TARGE...)
*** Error 2 in /usr/ports/print/luametatex (/usr/ports/infrastructure/mk/bsd.port.mk:2704 'all': @lock=luametatex-2.10.08p0;  export _LOCKS_...)
$ file /usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz                            
/usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz: gzip compressed data, from Unix

It says the file is not there, but it is there. Why does it say the package is unsigned? Did I misconfigure something?

I run snapshot, so current for ports.

[jggimi]

My /etc/mk.conf includes this line:

SUDO=doas

This doesn't appear explicitly in the Porter's Handbook -- which I think may be an oversight. It is discussed in both ports(7) and bsd.port.mk(5).


Edited to add -- it's also in mk.conf(5) -- though getting to that man page from port logs alone wouldn't be obvious.

[hulten]

Still no luck:

$ cat /etc/mk.conf 
PORTS_PRIVSEP=Yes
SUDO=doas
$ pwd
/usr/ports/print/luametatex
$ make build
===> luametatex-2.10.08p0 depends on: ninja-* - not found
===>  Verifying install for ninja-* in devel/ninja
`/usr/ports/bulk/amd64/ninja-1.11.1p0v0' is up to date.
===>  Installing ninja-1.11.1p0v0 from /usr/ports/packages/amd64/all/
quirks-7.70 signed on 2024-11-18T18:55:56Z
file:/usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz: unsigned package
Can't find /usr/ports/packages/amd64/all/ninja-1.11.1p0v0.tgz
Couldn't install ninja-1.11.1p0v0
*** Error 1 in /usr/ports/devel/ninja (/usr/ports/infrastructure/mk/bsd.port.mk:2260 '/var/db/pkg/ninja-1.11.1p0v0/+CONTENTS': @/usr/bin/env...)
*** Error 2 in /usr/ports/devel/ninja (/usr/ports/infrastructure/mk/bsd.port.mk:2704 'install': @lock=ninja-1.11.1p0v0;  export _LOCKS_HELD=...)
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2386 '/usr/ports/pobj/luametatex-2.10.08/.dep-devel-ninja': @unset _DEPENDS_TARGE...)
*** Error 2 in /usr/ports/print/luametatex (/usr/ports/infrastructure/mk/bsd.port.mk:2704 'build': @lock=luametatex-2.10.08p0;  export _LOCK...)

I am still reading documentation.

[jggimi]

I can't tell from these messages what the issue might be. One thing you could do is clean out the contents of $WRKOBJDIR (/usr/ports/pobj, by default), and start the build again. Another would be to run pkg_check(8), to ensure your installed package database is in an inconsistent state.


Building ports will create unsigned packages. The ports infrastructure will install unsigned packages it builds, you can also install manually built packages with the `-D unsigned` option of pkg_add(1). For distribution, the OpenBSD Project signs the packages it builds with signify(1), using the convenience script pkg_sign(1).

[hulten]

Before retrying to build and install more complex ports like luametatex, I want to get the permission configuration right (and understand it). It is not yet right.

In my doas.conf I have

permit keepenv nopass root as _pbuild
permit keepenv nopass root as _pfetch

which is just—if I understand doas.conf(5) right—to be sure that building is done as an unpriviledged user when I happen to run 'make' or 'make fetch' or so as root. This is fine but irrelevant if I want to build as a normal user.

Now, the internets told me—I forgot the website—to add my user to wsrc and add this to doas.conf:

permit nopass setenv { FTPMODE PKG_CACHE PKG_PATH SM_PATH SSH_AUTH_SOCK DESTDIR DISTDIR FETCH_CMD FLAVOR GROUP MAKE MAKECONF MULTI_PACKAGES NOMAN OKAY_FILES OWNER PKG_DBDIR PKG_DESTDIR PKG_TMPDIR PORTSDIR RELEASEDIR SHARED_ONLY SUBPACKAGE WRKOBJDIR SUDO_PORT_V1 } :wsrc

Ah, that works. But a lot more works and I don't want that.

Of course, the documentation refers to bsd.port.mk(5). This does not mention wsrc. I also cannot find any file in group wsrc below /usr/ports/.

I am a bit overwelmed by the documentation. A little push to the right direction would be great. :-)

[jggimi]

I'll share what I typically use for port building.

1. My user is added to the wsrc group in /etc/groups.
2. I copy/paste the wsrc group permit rule from /etc/examples/doas.conf into /etc/doas.conf. This is the rule with the ridiculously long set of environment variables, described as "Non-exhaustive."
3. I use a 5-line /etc/mk.conf, which I'll share below. I'm happy to answer any questions you may have about it:

FETCH_PACKAGES= -Dsnap
PORTSDIR_PATH=  ${PORTSDIR}/mystuff:$(PORTSDIR)/openbsd-wip:${PORTSDIR}
SUDO=           doas
PORTS_PRIVSEP=  Yes
USE_CCACHE=     Yes

And I use different two rules for _pbuild and _pfetch, needed for PORTS_PRIVSEP: I allow my user, rather than root, to issue commands as those two userids.