Created attachment 247365 [details]
git diff graphics/oidn

I have /usr/ports/distfiles mounted noexec and while i realize that in and of itself is no security panacea i'd like to keep it that way as part of a broader defense in depth policy

At any rate, none of the other 3000+ ports i build for my organization try to invoke any executable from ${DISTDIR} and I think we just might be able to agree that none should.

So, upon investigating this case, I have determined the executable in question to effectively be one big NOOP. The attached patch merely adds --no-checkout to the `git clone` operation (in its short form, -n) to bypass the error altogether while creating an identical tarball. Admittedly, this quick fix renders the construct being used by the pre-fetch target here to be less robust and flexible in the face of hypothetical future updates to the origin distribution repository.

I like the method and practice the pre-fetch construct in this port employs to create a reproducible distfile. If it is known by anyone reading to be a useful or common construct I would be happy to further investigate or participate in deciding/writing a more robust and generic solution.

===>  Cleaning for oidn-2.1.0
===>  License APACHE20 accepted by the user
==> Fetching the oidn/weights subproject with large LFS files
Downloading rt_alb.tza (1.8 MB)
Downloading rt_hdr.tza (1.8 MB)
Downloading rt_hdr_alb.tza (1.8 MB)
Downloading rt_hdr_alb_nrm.tza (1.8 MB)
Downloading rt_hdr_calb_cnrm.tza (1.8 MB)
Downloading rt_ldr.tza (1.8 MB)
Downloading rt_ldr_alb.tza (1.8 MB)
Downloading rt_ldr_alb_nrm.tza (1.8 MB)
Downloading rt_ldr_calb_cnrm.tza (1.8 MB)
Downloading rt_nrm.tza (1.8 MB)
Downloading rtlightmap_dir.tza (1.8 MB)
Downloading rtlightmap_hdr.tza (1.8 MB)
fatal: cannot exec '/usr/ports/distfiles/oidn-weights-4322c25e25a05584f65da1a4be5cef40a4b2e90b/.git/hooks/post-checkout': Permission denied
*** Error code 1

Stop.
make: stopped in /usr/ports/graphics/oidn
root@matrix:~ # mount|grep distfiles
neo/os/FreeBSD/ports/distfiles on /usr/ports/distfiles (zfs, local, noatime, noexec, nosuid, nfsv4acls)
root@matrix:~ #