From owner-freebsd-ports@FreeBSD.ORG Fri Apr 22 05:37:35 2005 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3D3A116A4CE for ; Fri, 22 Apr 2005 05:37:35 +0000 (GMT) Received: from dppl.com (sapas.dppl.com [216.182.10.231]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8C05A43D46 for ; Fri, 22 Apr 2005 05:37:34 +0000 (GMT) (envelope-from yds@CoolRat.org) Received: from [192.168.1.73] (pcp0011284575pcs.union01.nj.comcast.net [69.248.144.22]) (AUTH: PLAIN yds, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by dppl.com with esmtp; Fri, 22 Apr 2005 01:37:32 -0400 Date: Fri, 22 Apr 2005 01:37:30 -0400 From: Yarema To: Oliver Lehmann Message-ID: In-Reply-To: <20050421195031.3783d207.lehmann@ans-netz.de> References: <20050414111426.775f6afd.lehmann@ans-netz.de> <200504191258.53327.freebsd@redesjm.local> <20050419173039.4725638a.lehmann@ans-netz.de> <200504191827.05896.ports@dino.sk> <20050420121254.34c59e53.lehmann@ans-netz.de> <9F0C7E4FBA18BFD0B3946DFE@tuber.coolrat.org> <20050420205646.5c7b72df.lehmann@ans-netz.de> <13A599297289B8FA39CA73DB@tuber.coolrat.org> <20050421195031.3783d207.lehmann@ans-netz.de> X-Mailer: Mulberry/3.1.6 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline cc: ports@FreeBSD.org cc: ports@dino.sk cc: josemi@freebsd.jazztel.es Subject: Re: splitting courier-authlib into master+slave ports X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Apr 2005 05:37:35 -0000 --On Thursday, April 21, 2005 7:50 PM +0200 Oliver Lehmann wrote: > Yarema wrote: > >> Hello again Oliver, >> >> Another rewrite, putting some code where my mouth is... ;) >> >> This one is based on the latest version you provided. > > Other point: > > @${CHMOD} -h 0444 ${PREFIX}/lib/${PORTNAME}/* > I don't like that too - using asterisk is evil imho. None know to what it > expands. I won't touch the libs after they are installed. They are > getting installed with the right rights or not. Changing the rights > later is bad design imho. SowWhat I see is changing the installation > procedure or just don't touch the rights. I prefer the later. Take it > as it gets shipped will cause less pain imho. If someone wants a > restricted modes setup he can change it by his own, or change /usr/share/ > mk/bsd.own.mk. (If someone wants that, he knows what he has to do to get > it) Thing is that the provided courier-authlib install targets do not honor /usr/share/mk/bsd.own.mk .. I think it's our responsibility as port author's to ensure as secure an install of a package as possible. And you're right, the ${CHMOD} wildcard is a lazy way to go about it. But it produces the same results as patching the install routines. The real problem is that with FreeBSD ports we don't have a safe staging area to install to and fix all the permissions, delete unneeded files, etc. ... and THEN roll a package with everything fixed up just right. I consider ${PREFIX} to be a staging area up until the package gets recorded in /var/db/pkg/ with an MD5 for every file. That's why I take the extra steps in the Makefile to fix things up. But I won't dispute that my way of going about it is not always prettiest. I do believe it's better than trusting the author of whatever is being ported to know how to install things properly according to FreeBSD Porter's Handbook and hier(7) guidelines. So if a the install routines don't leave things with permissions according to FreeBSD conventions they should be fixed. By they I mean the installed files, but if the install routines are fixed, even better. I chose the lazy way to go about it, I admit. But in the very least I think that no binary file (executable or library) should have the write bit set no matter what. Notice that the plugin subports install things correctly via the override do-install target. It's that the master port relies on the provided install routines. And those are not FreeBSD specific so they leave things in a less than ideal state. Writing override do-install targets for every port is just impractical. And figuring out how to patch all the provided install routines is an even more Herculean undertaking. So fixing things up in the post-install target seems the most practical. -- Yarema http://yds.CoolRat.org