Docker fixes - #38
Conversation
Running as an arbitrary host UID/GID has no matching /etc/passwd entry inside the container, so $HOME resolves to "/" and pkg install fails trying to create /.local/share/octave. Point HOME at the bind-mounted, host-owned workspace instead.
GIT_CONFIG_COUNT/GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n (added in git 2.31) and `git -c safe.directory=...` are both silently ignored by the git 2.25.1 bundled with the gnuoctave/octave:6.4.0 and :7.3.0 images, so the previous workaround left `git archive` failing with "detected dubious ownership" whenever the repo isn't owned by the invoking user (e.g. GitHub Actions container jobs, or root in a bind-mounted Docker container). Write safe.directory to an actual (scoped, throwaway) global gitconfig instead, which every git version here honors.
AC_CONFIG_MACRO_DIRS (plural) requires autoconf >= 2.70; the codebase doesn't otherwise need anything from 2.70/2.71, so switch to the singular AC_CONFIG_MACRO_DIR, which both old and new autoconf accept, and drop AC_PREREQ accordingly. This lets `make check-ci`/bootstrap succeed on the gnuoctave/octave:7.3.0 image, which ships Ubuntu 20.04's autoconf 2.69. Verified bootstrap+configure+check-ci pass on octave 7.3.0, 8.4.0, 9.4.0, 10.3.0, and 11.3.0 images.
|
Yikes, it seems that v7.3.0 was still failing, but now due to an unrelated issue caused by an outdated Pushed a fix for that too... |
| environment: | ||
| HOME: /workspace |
There was a problem hiding this comment.
This works and makes sense, but it's also worth considering using /tmp/. tmp is permissive so the .local/share (which gets created when you start octave) and .config/octave/ (which gets created when you pkg install) get created in an ephemeral /tmp/ and I don't think you'd need to add anything to the .gitignore.
I'm not 100% sure of any trade-offs but it's worth considering I think.
There was a problem hiding this comment.
So I was trying to be clever here and use this whole GIT_CONFIG_COUNT mess to get around the fact that the tarball builds with git archive isn't run as the same user that owns the git repo (b/c it's run in docker) (after a deep rabbit hole that's thanks to CVE-2022-24765).
But it turns out that feature was added in git 2.31, and guess what versions 6.4.0 and 7.3.0 got built with:
~/workspace/pkg-control > docker run --rm gnuoctave/octave:11.3.0 git --version
git version 2.53.0
~/workspace/pkg-control > docker run --rm gnuoctave/octave:7.3.0 git --version
git version 2.25.1
~/workspace/pkg-control > docker run --rm gnuoctave/octave:6.4.0 git --version
git version 2.25.1I think your solution is probably cleaner/simpler though I'm surprised it works with safe.directory b/c that got added later? But I'm guessing it was back-ported to previous releases specifically for the CVE. At any rate, if it works it works.
|
Thanks for the patch, th review and the discussion. I am going to merge the pull request and will make some tests with /tmp as heom directory or at least with one single dir wihtin |
3 participants
Fixes for #36 (comment)