Bug 941685 – stage3 tarballs: empty /var/db/repos/ leads to repo syncs being done by root

• Product: Gentoo Release Media
• Status: RESOLVED FIXED

[Description David Sardari 2024-10-17 08:26:28 UTC]

By default, stage3 tarballs come with an empty "/var/db/repos/" folder. This leads to the initial sync and any subsequent sync being done by root. This issue has been described for different sync methods:
- webrsync: bug 707980
- git and rsync: bug 941605

I wish for a portage:portage owned empty "/var/db/repos/gentoo" folder to be provided with the stage3 tarball in order to ensure that repo syncs are done by the "portage" user, at least, for the official repo.

Reproducible: Always

Steps to Reproduce:
1. rm -rf /var/db/repos/gentoo
2. emaint --auto sync
Actual Results:  
$ ps au | grep rsync
root        7294  3.6  0.4 619008 35056 pts/1    S+   09:23   0:02 rsync --recursive --links --safe-links --perms --tim
root        7295 15.0  0.3 692000 27808 pts/1    S+   09:23   0:09 rsync --recursive --links --safe-links --perms --tim

Expected Results:  
$ ps au | grep rsync
portage        7294  3.6  0.4 619008 35056 pts/1    S+   09:23   0:02 rsync --recursive --links --safe-links --perms --tim
portage        7295 15.0  0.3 692000 27808 pts/1    S+   09:23   0:09 rsync --recursive --links --safe-links --perms --tim


Obviously, this won't mitigate the problems of syncs done by root for overlays which were added with eselect-repository:
https://github.com/projg2/eselect-repository/issues/30

At least, however, this covers the more important offial repo.

[Comment 1 Sam James 2024-10-17 08:30:17 UTC]

We should probably do this as it's an easy workaround. It'll also remove the scary warning on first sync I think for non-existent dir.

But one question is if it's going to break people who are relying on being able to mount there in a stage3.

[Comment 2 Andreas K. Hüttel 2025-01-21 21:11:16 UTC]

(In reply to Sam James from comment #1)
> We should probably do this as it's an easy workaround. It'll also remove the
> scary warning on first sync I think for non-existent dir.

Yes. I'll have a look.

> But one question is if it's going to break people who are relying on being
> able to mount there in a stage3.

I dont think this is a problem anymore. As far as I know, if you mount on a directory that has contents, the contents are just silently shadowed.

[Comment 3 Sam James 2025-01-21 21:58:58 UTC]

commit b51ceb558a282b8fdfc3952f81be037caa3d5fbe
Author: Andreas K. Hüttel <[e-mail]>
Date:   Tue Jan 21 22:46:50 2025 +0100

    Ensure that the repo_base directory is owned by portage:portage

    This allows emerge to use usersync from the start

    Signed-off-by: Andreas K. Hüttel <[e-mail]>

[Comment 4 Andreas K. Hüttel 2025-01-21 22:45:01 UTC]

commit b51ceb558a282b8fdfc3952f81be037caa3d5fbe
Author:     Andreas K. Hüttel <[e-mail]>
AuthorDate: Tue Jan 21 22:46:50 2025 +0100
Commit:     Andreas K. Hüttel <[e-mail]>
CommitDate: Tue Jan 21 22:51:07 2025 +0100

    Ensure that the repo_base directory is owned by portage:portage
    
    This allows emerge to use usersync from the start
    
    Signed-off-by: Andreas K. Hüttel <[e-mail]>

 catalyst/base/stagebase.py | 5 +++++
 1 file changed, 5 insertions(+)



This is fixed with the next stage builds.

[Comment 5 Denis Lisov 2025-01-22 13:53:44 UTC]

I wonder whether it's a good idea to default to syncing repos as the same user that's used for building packages with userpriv... should a package being built have write access to repositories?