When building Debian packages by using the autogen options "--enable-epm --with- epm=internal --with-package-format=deb", the files in the generated deb packages do not belong to root:root as they should, but rather to the user who did the build. This happens when the system has a current version of "tar" installed. The outcome is basically the same as already described in bug 67388.
I'm currently having a look to find the root cause. So far, it looks very much like a change in the "tar" utility used by "dpkg --build" (which in turn is used by "epm") is causing the issue. I can reproduce the on Debian testing and CentOS 7, but not on CentOS 7. When use a tar version built from its upstream git repository, the problem is also reproducible on CentOS 6. The deb packages offered on the LibreOffice website and the daily builds e.g. available at https://dev-builds.libreoffice.org/daily/master/Linux-rpm_deb-x86@71-TDF/ are currently not affected (probably because the system on which those are built has an older tar version...).
(In reply to Michael Weghorn from comment #1) > I can reproduce the on Debian testing and CentOS 7, but not on CentOS 7. Sorry, this makes no sense. What I wanted to say is this: "I can reproduce the problem on Debian testing and CentOS 7, but not on CentOS 6."
Rene: since it concerns Debian, thought you might be interested in this one.
I think I've found the cause, will add more details and a suggestion on how to fix this later (probably next week).
The corresponding commit in the tar git repository from which one this no longer works as expected is the following: commit de328a580ab6f5ff4a3237ce21f1ef0b7dd12984 Author: Paul Eggert <eggert@cs.ucla.edu> Date: Mon Sep 6 13:38:44 2010 -0700 tar: more reliable directory traversal when creating archives The relevant change in this commit is that lstat() is no longer called. Adding the lstat() call for testing reasons to the current tar version (1.30, git commit f8459cf8387cc2c7b3f1818a6379957fc23f5a21) as follows makes the ownerships be OK again. diff --git a/src/create.c b/src/create.c index 35bcf5b..94fd6e0 100644 --- a/src/create.c +++ b/src/create.c @@ -1697,6 +1697,9 @@ dump_file0 (struct tar_stat_info *st, char const *name, char const *p) diag = stat_diag; } } + // NOTE: If this is added, packages in the Debian packages created by + // the LibreOffice build have correct ownerships again (root:root) + lstat(p, &st->stat); if (diag) { file_removed_diag (p, top_level, diag); There is an LD_PRELOAD for 'libgetuid.so' generated and used by LibreOffice which does redefine '__lxstat()'; therefore things work when 'lstat()' is used. '__fstat()' is currently not redefined in LO's libgetuid.
I currently see two options two fix this: 1) extend LO's libgetuid by redefining those functions that are needed in addition to fool the new tar version. 2) use the "fakeroot" tool when building deb packages which takes care of all needed things and "just works" (™) I have submitted changes to gerrit that demonstrate both approaches: https://gerrit.libreoffice.org/#/c/49596/ https://gerrit.libreoffice.org/#/c/49597/ I'd be happy to hear which approach is preferred. The suggested change for the first approach (exytending libgetuid) does not yet fix the ownership of the symlinks in the libreoffice<VERSION>-debian-menus package
In addition to the files inside the Debian packages themselves, the ownerships in the following files are also not OK: In addition to the Debian packages themselves, a tar archive holding all of the Debian packages is created at the end of the build (sample file as of current master: './workdir/installation/LibreOfficeDev/deb/install/LibreOfficeDev_6.1.0.0.alpha0_Linux_x86-64_deb_download/LibreOfficeDev_6.1.0.0.alpha0_Linux_x86-64_deb.tar.gz'). The single Debian packages inside this tar archive also belong to the user who did the build. The same probably applies in case rpm packages are built instead of deb packages. Ownerships in tar archives created with the "--with-package-format=archive" option are also incorrect.
Michael Weghorn committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=bcc5790554f02d65b03eebcc47fb8859fcf44643 tdf#115554: Use 'fakeroot' to build Debian packages It will be available in 6.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Michael Weghorn committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=2b266a338718ccd994a4cef05f128eb0c1b9fdc7 tdf#115554: Create tar archives using 'fakeroot' It will be available in 6.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Michael Weghorn committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=0add6dbacbed852f2b5180e04571f039cbf9dd0b tdf#115554: Fix ownership in desktop-integration tars It will be available in 6.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
The issue is fixed by the commits mentioned in comments 8 to 10.