GNU bug report logs - #19615
make dist tarball contains owner/group information from the build system

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 19615 in the body.
You can then email your comments to 19615 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Dimitrios Apostolou <jimis <at> gmx.net>
To: bug-automake <at> gnu.org
Subject: make dist tarball contains owner/group information from the build
 system
Date: Fri, 16 Jan 2015 16:07:03 +0100 (CET)

(Please CC me in the replies as I'm not subscribed)

Hello list,

examing the tarballs generated by "make dist" using "tar -tzvvf", it seems 
that information about group/owner of the buildsystem is being leaked. 
Example output - notice the jenkins/jenkins field:

# tar -tzvvf core/cfengine-3.7.0a1.5ffcc54.tar.gz   | head
drwxrwxr-x jenkins/jenkins   0 2015-01-16 02:54:12 cfengine-3.7.0a1.5ffcc54/
-rw-rw-r-- jenkins/jenkins 34036 2015-01-16 02:53:55 cfengine-3.7.0a1.5ffcc54/Makefile.in
-rwxrwxr-x jenkins/jenkins 658314 2015-01-16 02:53:51 cfengine-3.7.0a1.5ffcc54/configure
-rw-rw-r-- jenkins/jenkins   4973 2014-10-27 14:39:26 cfengine-3.7.0a1.5ffcc54/Makefile.am

My workaround is to add the following in Makefile.am:

TAR_OPTIONS = --owner=0 --group=0
export TAR_OPTIONS

I expected that something like this would be the default though.


Thanks,
Dimitris

Message #8 received at 19615 <at> debbugs.gnu.org (full text, mbox):

From: Pavel Roskin <proski <at> gnu.org>
To: 19615 <at> debbugs.gnu.org
Subject: make dist tarball contains owner/group information from the build
 system
Date: Thu, 4 Feb 2016 18:27:57 -0800

My situation is even worse. My user ID is so large that "make dist"
fails for me:

tar: value 3186326 out of uid_t range 0..2097151
tar: Exiting with failure status due to previous errors
gtar: value 3186326 out of uid_t range 0..2097151
gtar: Exiting with failure status due to previous errors

The fix was promised back in year 2008. I hope we'll see it. In the
days of cloud computing, large user ID is an everyday reality.
http://comments.gmane.org/gmane.comp.sysutils.automake.bugs/4340

-- 
Regards,
Pavel Roskin

Message #15 received at 19615 <at> debbugs.gnu.org (full text, mbox):

From: Bogdan <bogdro_rep <at> gmx.us>
To: 19615 <at> debbugs.gnu.org
Subject: [PATCH] make dist tarball contains owner/group information from the
 build system
Date: Wed, 15 Mar 2023 22:16:00 +0100

Hi.

Please see https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60419 for a 
possible solution.

-- 
Regards - Bogdan ('bogdro') D.                 (GNU/Linux & FreeDOS)
X86 assembly (DOS, GNU/Linux):    http://bogdro.evai.pl/index-en.php
Soft(EN): http://bogdro.evai.pl/soft  http://bogdro.evai.pl/soft4asm
www.Xiph.org  www.TorProject.org  www.LibreOffice.org  www.GnuPG.org

Message #20 received at 19615 <at> debbugs.gnu.org (full text, mbox):

From: Karl Berry <karl <at> freefriends.org>
To: jimis <at> gmx.net, proski <at> gnu.org, bogdro <at> gmx.com
Cc: 19615 <at> debbugs.gnu.org, 60419 <at> debbugs.gnu.org
Subject: Re: bug#19615: make dist tarball contains owner/group information
 from the build system
Date: Thu, 29 Jun 2023 19:01:11 -0600

Hi Dimitrios and all,

Back on this bug from 2015 and earlier (yikes, sorry):
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=19615

    TAR_OPTIONS = --owner=0 --group=0
    I expected that something like this would be the default though.

I agree it would be desirable, in theory.  But we can't make it the
default because it's not portable.  It would also be a big change from
existing practice.

I think adding it in projects' Makefile.am is as good as it gets.
Certainly much simpler than trying to determine whether tar supports
--owner/--group at "make dist" time, and then providing options as to
whether to use them or not. Or which options to use. Etc.

Thus, instead of making any change to the code (sorry again), I merely
added a note to the manual about it.

    pavel> The fix was promised back in year 2008. I hope we'll see it. 

If one of the past or current Automake maintainers has code to deal with
this, I hope they'll say.

    http://comments.gmane.org/gmane.comp.sysutils.automake.bugs/4340

404. I didn't try to guess which bug-automake message that might refer to.

    bogdan> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60419
    ... a patch that allows Automake users to provide their own 
    command-line options that will be passed to the 'tar' utility when
    ...
    -  [am__tar='$${TAR-tar} chof - "$$tardir"' am__untar='$${TAR-tar} xf -'],
    +  [am__tar='$${TAR-tar} c $${TAR_OPTIONS} -hof - "$$tardir"' am__untar='$${TAR-tar} x $${UNTAR_OPTIONS} -f -'],

Unfortunately this sort of change is not portable. tar option parsing is
a strange and wonderful area. Non-dash options ("c") can't be mixed with
dash options (-hof). Conceivably we could switch to all dash options
(... -chof - $${TAR_OPTIONS} ...), but Automake currently goes to a lot
of trouble to support even the oldest tars, which don't support dash
options at all. And I'm not sure dash options (with older tars) can be
separated into different groups.

Although such ancient-tar support is probably not important nowadays,
more fundamentally, I don't see anything to be gained. Either GNU tar is
being used, in which case it already supports the TAR_OPTIONS envvar
itself, or it's not, in which case either there are different options or
no options at all for the job, and something different has to be
done. Automake can't solve that problem, as far as I can see. For
instance, trying to chown the unpacked tree before tarring would fail.

    This "bug report" can be merged with 19615 or simply deleted.

My attempts to use debbugs to merge the reports failed for no clear
reason. Closing both bugs separately. --thanks, karl.

-----------------------------------------------------------------------------
doc: discuss setting uid/gid information in tarballs.

In response to https://bugs.gnu.org/19615.

* doc/automake.texi (Basics of Distribution): give
example of specifying the TAR_OPTIONS (environment)
variable used by GNU tar.
diff --git a/doc/automake.texi b/doc/automake.texi
index a56e7f8ee..1bf74cd73 100644
--- a/doc/automake.texi
+++ b/doc/automake.texi
@@ -8621,12 +8621,30 @@ More precisely, the gzipped @code{tar} file is named

 @c See automake #9822.
 @vindex TAR
-You can set the environment variable @code{TAR} to override the tar
-program used; it defaults to @code{tar}.  @xref{The Types of
-Distributions}, for how to generate other kinds of archives.
+You can set the environment (or @code{Makefile.am}) variable @code{TAR}
+to override the tar program used; it defaults to @code{tar}.
+@xref{The Types of Distributions}, for how to generate other kinds of
+archives.

-For the most part, the files to distribute are automatically found by
-Automake:
+@vindex TAR_OPTIONS
+With GNU tar, you can also set the environment (or @code{Makefile.am})
+variable @code{TAR_OPTIONS} to pass options to @code{tar}.  One common
+case for this is wanting to avoid using the local user's uid and gid
+in the tar file, or the uid being larger than is supported by the tar
+format (not uncommon nowadays). This can be done with, for example>
+
+@example
+TAR_OPTIONS = --owner=0 --group=0
+export TAR_OPTIONS
+@end example
+
+@noindent
+The @code{export} (a GNU make feature) is necessary to pass the
+variable in the environment to the @code{tar} invocation.
+(For more discussion, see @url{https://bugs.gnu.org/19615}.)
+
+For the most part, the files to distribute are automatically
+found by Automake:

 @itemize @bullet
 @item
@@ -11376,13 +11394,12 @@ time may be overridden: @code{make V=1} will produce verbose output,
 @code{make V=0} less verbose output.

 Unfortunately, if @code{V} is assigned a value other than 0 or 1,
-errors will result. This is problematic when a third-party program or
+errors will result.  This is problematic when a third-party program or
 library is built in the same tree and also uses the make variable
-@code{V}, with different values. The best workaround is probably to
+@code{V}, with different values.  The best workaround is probably to
 set @code{AM_V_P=true} (or similar), either on the make command line
-or in the @code{V}-using project's @code{Makefile.am}. For more
-discussion:
-@url{https://debbugs.gnu.org/cgi/bugreport.cgi?bug=20077}.
+or in the @code{V}-using project's @code{Makefile.am}.  (For more
+discussion, see @url{https://bugs.gnu.org/20077}.)
 @end itemize

 @cindex default verbosity for silent rules

compile finished at Thu Jun 29 17:59:48 2023

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.