Bug 269524

Summary: security/opencryptoki: 'make stage' as regular user fails to install p11sak_defined_attrs.conf.sample
Product: Ports & Packages Reporter: John Hein <jcfyecrayz>
Component: Individual Port(s)Assignee: Robert Clausecker <fuz>
Status: Closed FIXED    
Severity: Affects Some People CC: fuz, hrs, ohartmann
Priority: --- Flags: fuz: maintainer-feedback-
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
[patch] fix 'make stage' permission failure fuz: maintainer-approval+

Description John Hein 2023-02-13 05:35:06 UTC 
Doing 'make -C security/opencryptoki stage' as a regular user (who is not in the _pkcs11 group), results in the following error:

 .
 .
test -f /usr/ports/security/opencryptoki/work/stage/usr/local/etc/opencryptoki/p11sak_defined_attrs.conf.sample || /usr/bin/install -c -g _pkcs11 -m 0640 ./usr/sbin/p11sak/p11sak_defined_attrs.conf /usr/ports/security/opencryptoki/work/stage/usr/local/etc/opencryptoki/p11sak_defined_attrs.conf.sample || true
install: /usr/ports/security/opencryptoki/work/stage/usr/local/etc/opencryptoki/p11sak_defined_attrs.conf.sample: chown/chgrp: Operation not permitted
 .
 .

The build does not fail at that point because the actual command in the opencryptoki-3.19.0/Makefile has "|| true".  It's not clear why the '|| true' is there, but it is caught later when 'make install' runs:

===>   Registering installation for opencryptoki-3.19.0 as automatic
pkg-static: Unable to access file /usr/ports/security/opencryptoki/work/stage/usr/local/etc/opencryptoki/p11sak_defined_attrs.conf.sample:No such file or directory
pkg-static: Fail to apply keyword 'sample'
*** Error code 1


This happened with the update to 3.19.0 (ports e83df13905e945f1b776a84ff8abfeda29f04743) which added the -g _pkcs11 to the install line in the Makefile.  That is not necessary since the sample entry for p11sak_defined_attrs.conf specifies the group ownership in pkg-plist (and will be set correctly when the package is installed).
Comment 1 John Hein 2023-02-13 06:02:18 UTC 
Created attachment 240123 [details]
[patch] fix 'make stage' permission failure

Simple fix to remove the '-g ' option.  Just let the @sample() parameters in pkg-plist set the group permissions.

No need to bump PORTREVISION as this will not change a package that was built as root instead of a regular user.
Comment 2 Robert Clausecker freebsd_committer freebsd_triage 2023-04-19 16:07:20 UTC 
*** Bug 270028 has been marked as a duplicate of this bug. ***
Comment 3 Robert Clausecker freebsd_committer freebsd_triage 2023-04-19 16:08:45 UTC 
Comment on attachment 240123 [details]
[patch] fix 'make stage' permission failure

maintainer timeout
Comment 4 Robert Clausecker freebsd_committer freebsd_triage 2023-04-19 16:11:25 UTC 
Thank you for your submission.  Will commit shortly.
Comment 5 commit-hook freebsd_committer freebsd_triage 2023-04-20 13:36:15 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=6714a2486ac92293aeed04f5cdac6ac546da0497

commit 6714a2486ac92293aeed04f5cdac6ac546da0497
Author:     John Hein <jcfyecrayz@liamekaens.com>
AuthorDate: 2023-04-19 16:09:44 +0000
Commit:     Robert Clausecker <fuz@FreeBSD.org>
CommitDate: 2023-04-20 11:49:23 +0000

    security/opencryptoki: fix build as non-root

    Simple fix to remove the '-g ' option.  Just let the @sample()
    parameters in pkg-plist set the group permissions.

    Approved by:    hrs (maintainer timeout)
    MFH:            2023Q2
    PR:             269524

 security/opencryptoki/files/patch-Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 6 commit-hook freebsd_committer freebsd_triage 2023-04-20 13:37:26 UTC 
A commit in branch 2023Q2 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=6bf7787c8837b93096cc92cb049a8cf1b87898ce

commit 6bf7787c8837b93096cc92cb049a8cf1b87898ce
Author:     John Hein <jcfyecrayz@liamekaens.com>
AuthorDate: 2023-04-19 16:09:44 +0000
Commit:     Robert Clausecker <fuz@FreeBSD.org>
CommitDate: 2023-04-20 13:36:52 +0000

    security/opencryptoki: fix build as non-root

    Simple fix to remove the '-g ' option.  Just let the @sample()
    parameters in pkg-plist set the group permissions.

    Approved by:    hrs (maintainer timeout)
    MFH:            2023Q2
    PR:             269524

    (cherry picked from commit 6714a2486ac92293aeed04f5cdac6ac546da0497)

 security/opencryptoki/files/patch-Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 7 Robert Clausecker freebsd_committer freebsd_triage 2023-04-20 13:40:07 UTC 
Thank you for your contribution.