RFC: bee-mxqsub: Run only install and packaging under fakeroot

[Paul Menzel (pmenzel)]

Use beesh --fakeroot (mariux64/bee#76) when available, falling back to fakeroot beesh. MXQ check: special owners and modes in 17 packages unchanged.

🤖 Generated with Claude Code

[Paul Menzel (pmenzel)]

This comment was generated by an LLM (Claude Code) on behalf of Paul Menzel (@pmenzel).

Result of the MXQ check: packages built with beesh --fakeroot (bee#76) have the same owners and modes as packages built with fakeroot beesh.

• 17 packages with setuid/setgid files or files not owned by root were built both ways.
• All 36 special files are identical in type, mode, owner and group, among 2335 files in total. These include mount/umount, sudo, su, newuidmap, Xorg.wrap, ssh-keysign, pkexec, mxq’s setuid nobody binaries, and the directories owned by gdm and polkitd.
• The only differences are extra root-owned directory entries such as /usr/lib/pkgconfig. They come from the test setup: bee installed into a private prefix reads that prefix’s default skiplist instead of /etc/bee/skiplist.

Details of the test are in the next comment.

[Paul Menzel (pmenzel)]

This comment was generated by an LLM (Claude Code) on behalf of Paul Menzel (@pmenzel).

How the change was tested

1. Which packages to check

Packages whose CONTENT has a setuid/setgid/sticky file or a file not owned by root, among the 1076 packages installed on the submit host:

cd /usr/share/bee
for p in */; do
    n=$(grep -cE 'access=0?[2-7][0-7]{3}:|:uid=[1-9]|:gid=[1-9]' "$p/CONTENT")
    [ "$n" -gt 0 ] && echo "$n ${p%/}"
done

That gives 22 packages. Left out were linux and nvidia_linux, whose released packages contain files owned by the building user, a separate issue. That leaves 20 recipes: colord cronie davfs2 dbus fping fuse2 inetutils libcgroup libfuse lightdm mxq nfs-utils openssh polkit shadow slock sudo util-linux xorg-server xscreensaver.

2. Can configure or build depend on running as root?

With --fakeroot, configure and build see the real UID. A configure script that checks the UID could write "not root" into a generated Makefile, and the later make install would then skip chown or setuid.

• Searching configure.ac, Makefile.am, meson.build, *.mk and *.m4 of 15 of these upstream sources for id -u, whoami, $UID/$EUID, geteuid and the like turned up no such check.
• No recipe in bee-files does chown or checks the UID in mee_configure or mee_build.

3. Builds on MXQ

One job per variant on a full node, both with the same PATH except for the bee prefix. The build root is in /dev/shm, and each variant writes to its own private repository.

# old: installed bee, all of beesh under fakeroot (fallback)
scripts/bee-mxqsub -t 4h --no-overlay -k -B -c -B --no-archive-build \
    -E PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin \
    --repository ~/bee-fakeroot-test/repo-old <recipes>

# new: bee from bee#76 installed with PREFIX=~/bee-fakeroot-test/prefix
scripts/bee-mxqsub -t 2h --no-overlay -k -B -c -B --no-archive-build \
    -E PATH=$HOME/bee-fakeroot-test/prefix/bin:/usr/local/bin:… \
    --repository ~/bee-fakeroot-test/repo-new <recipes>

The job logs say === fakeroot: all of beesh (beesh lacks --fakeroot) and === fakeroot: install and packaging only (beesh --fakeroot), respectively. The new log also shows starting fakeroot and stopping fakeroot around the install step of each of the 17 packages.

Three recipes fail on master in either mode, so they were left out of the comparison:

• davfs2: linking mount.davfs fails.
• fuse2: error: conflicting types for 'closefrom', a conflict with glibc.
• dbus: 6 tests that start a dbus-daemon time out after 300 s during the build. The old job then stayed "running" after its last line, probably because of a leftover daemon, and had to be killed.

4. Comparison

The CONTENT files are compared without size, mtime and md5, so only type, mode, owner, group, nlink and path are left:

norm() {
    tar xOjf "$1" CONTENT |
        sed -E 's/:size=[0-9]*//; s/:mtime=[0-9]*//; s/:md5=[0-9a-f]*//' | sort
}
for n in repo-new/packages/*.bee.tar.bz2; do
    diff <(norm "repo-old/packages/${n##*/}") <(norm "$n")
done

Result: 8 packages are identical. In the other 9, the new package only has additional root-owned 0755 directory entries, such as /usr/lib/pkgconfig, /usr/share/aclocal and /usr/share/locale/*/LC_MESSAGES, and no line is missing or changed. The old run used BEE_SKIPLIST=/etc/bee/skiplist, while the new one used the default skiplist of the private prefix, …/prefix/etc/default/bee/skiplist, which lacks these entries. A bee installed to /usr reads /etc/bee/skiplist.

5. Local tests before that

• A test package whose Makefile installs with install -o root -m 4755, install -o 1234 and records id -u during build and install. With beesh --fakeroot the build recorded the real UID and the install recorded 0, and owners and modes matched fakeroot beesh.
• A failing make install leaves no faked process behind.
• fakeroot beesh --fakeroot reports the existing fakeroot and starts no second faked.
• The bee-mxqsub job phase was run locally with the new beesh, with the installed beesh (fallback), and with --env PATH=… pointing to the new beesh. The last case found an ordering bug, now fixed: the check whether beesh supports --fakeroot ran before --env was applied.

Not covered: packages in beeroot that are not installed on the submit host; build speed. These packages are small; the Firefox timing in the commit message (17:37 vs. 11:34) is the reference.