Skip to content

Docker fixes #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ttl-octave merged 3 commits into from
Jul 27, 2026
Merged

Docker fixes #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6559e38
devel/compose.yaml: set HOME so check-local works as non-root host user
pganguli Jul 27, 2026
bbb5955
Makefile: fix git archive safe.directory workaround for old git
pganguli Jul 27, 2026
d274b6a
src/configure.ac: lower autoconf requirement to 2.69
pganguli Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@ doc/control.svg
/src/slicot_src/*.f
/target

# HOME artifacts from `make check-local` (devel/compose.yaml sets HOME=/workspace)
/.local
/.config

# release checklists

devel/release/release_*.md
Expand Down
9 changes: 5 additions & 4 deletions Makefile
View file
Open in desktop

@MitchellThompkins MitchellThompkins Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I was trying to be clever here and use this whole GIT_CONFIG_COUNT mess to get around the fact that the tarball builds with git archive isn't run as the same user that owns the git repo (b/c it's run in docker) (after a deep rabbit hole that's thanks to CVE-2022-24765).

But it turns out that feature was added in git 2.31, and guess what versions 6.4.0 and 7.3.0 got built with:

~/workspace/pkg-control >  docker run --rm gnuoctave/octave:11.3.0 git --version
git version 2.53.0
~/workspace/pkg-control >  docker run --rm gnuoctave/octave:7.3.0 git --version
git version 2.25.1
~/workspace/pkg-control >  docker run --rm gnuoctave/octave:6.4.0 git --version
git version 2.25.1

I think your solution is probably cleaner/simpler though I'm surprised it works with safe.directory b/c that got added later? But I'm guessing it was back-ported to previous releases specifically for the CVE. At any rate, if it works it works.

Original file line number Diff line number Diff line change
Expand Up @@ -149,10 +149,11 @@ $(RELEASE_DIR_CI): .git/index
@-$(RM) -r $@
@mkdir -p $@
@echo " git archive ..."
@REV=$$(GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0="$(abspath .)" \
git stash create); \
GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0="$(abspath .)" \
git archive -o $@/tmp.tar $${REV:-HEAD}
@GIT_HOME=$$(mktemp -d); \
HOME=$$GIT_HOME git config --global --add safe.directory "$(abspath .)"; \
REV=$$(HOME=$$GIT_HOME git stash create); \
HOME=$$GIT_HOME git archive -o $@/tmp.tar $${REV:-HEAD}; \
$(RM) -r $$GIT_HOME
@cd $@ && tar -xf tmp.tar && $(RM) tmp.tar
$(COPY_SLICOT_AND_BOOTSTRAP)

Expand Down
2 changes: 2 additions & 0 deletions devel/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ services:
image: gnuoctave/octave:latest
working_dir: /workspace
user: "${HOST_UID:?set HOST_UID or run via make check-local, not docker compose directly}:${HOST_GID:?set HOST_GID or run via make check-local, not docker compose directly}"
environment:
HOME: /workspace
Comment on lines +6 to +7

@MitchellThompkins MitchellThompkins Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This works and makes sense, but it's also worth considering using /tmp/. tmp is permissive so the .local/share (which gets created when you start octave) and .config/octave/ (which gets created when you pkg install) get created in an ephemeral /tmp/ and I don't think you'd need to add anything to the .gitignore.

I'm not 100% sure of any trade-offs but it's worth considering I think.

volumes:
- .:/workspace:z
command: make check-ci
4 changes: 2 additions & 2 deletions src/configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# -*- Autoconf -*-
# Process this file with autoconf to produce a configure script.

AC_PREREQ([2.71])
AC_PREREQ([2.69])
AC_INIT([control],[4.2.2+])
AC_CONFIG_SRCDIR([sl_ab01od.cc])
AC_CONFIG_HEADERS([config.h])
Expand All @@ -10,7 +10,7 @@ AC_CONFIG_HEADERS([config.h])
# Octave.
AH_TOP([#include "undef-ah-octave.h"])

AC_CONFIG_MACRO_DIRS([m4])
AC_CONFIG_MACRO_DIR([m4])

# Checks for programs.
AC_CHECK_PROG(MKOCTFILE, mkoctfile, mkoctfile)
Expand Down