From bdbd6f5978b888dce9bb118e85b195ea523f396c Mon Sep 17 00:00:00 2001 From: agw Date: Sat, 3 Oct 2026 20:47:43 +0200 Subject: [PATCH] Fix the two publishing steps that had never run for real push-aur.sh: mktemp -d creates the work directory as 0700 root, so the builder user could not enter it to run makepkg ('cd: Permission denied'), and the git steps afterwards would refuse a tree owned by another user. Give builder the whole tree for makepkg and hand it back to root before git. record-state.sh: 'git diff --quiet' ignores untracked files, so the first state.json was reported as unchanged and never committed, which would have rebuilt and republished every night. Stage it before comparing. Both were found by the first publishing run; push-aur.sh was then tested end to end in a clean Arch container with a dummy key. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9 --- scripts/push-aur.sh | 7 ++++++- scripts/record-state.sh | 7 +++++-- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/scripts/push-aur.sh b/scripts/push-aur.sh index 7f9a840..eda90f7 100755 --- a/scripts/push-aur.sh +++ b/scripts/push-aur.sh @@ -42,12 +42,17 @@ if ! id builder &>/dev/null; then useradd -m builder echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers fi -chown -R builder:builder "$workdir/aur" +# The whole tree, not just aur/: mktemp -d creates $workdir as 0700 root, and +# builder could not even enter it to run makepkg ("cd: Permission denied"). +chown -R builder:builder "$workdir" echo ":: generating .SRCINFO" # The sha256sum is already correct from gen-pkgbuild.py (taken from the file we # just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums. sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO" +# Hand the tree back to root: the git commands below run as root, and git +# refuses to work in a repository owned by another user ("dubious ownership"). +chown -R root:root "$workdir" cd "$workdir/aur" git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}" diff --git a/scripts/record-state.sh b/scripts/record-state.sh index 19b6bcd..c21c2de 100755 --- a/scripts/record-state.sh +++ b/scripts/record-state.sh @@ -28,14 +28,17 @@ with open("state.json", "w") as fh: print(json.dumps(state, indent=2)) PY -if git diff --quiet -- state.json; then +# Stage first: `git diff` ignores untracked files, so on the very first run +# (no state.json in the repo yet) it reported "unchanged" and nothing was ever +# recorded, which would have rebuilt and republished every night. +git add state.json +if git diff --cached --quiet -- state.json; then echo ":: state.json unchanged" exit 0 fi git config user.name "jasp-bin autobuilder" git config user.email "noreply@weircon.dk" -git add state.json git commit -m "Record build of ${GITHUB_REF_NAME:-build}: $(python3 -c 'import json;print(json.load(open("state.json"))["jasp_version"])')" origin="$(git remote get-url origin)"