[Bug 276031] graphics/oidn: fetch target tries to execute from $DISTDIR

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=276031

            Bug ID: 276031
           Summary: graphics/oidn: fetch target tries to execute from
                    $DISTDIR
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: yuri@freebsd.org
          Reporter: milios@ccsys.com
          Assignee: yuri@freebsd.org
             Flags: maintainer-feedback?(yuri@freebsd.org)

Created attachment 247365
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=247365&action=edit
git diff graphics/oidn

I have /usr/ports/distfiles mounted noexec and while i realize that in and of
itself is no security panacea i'd like to keep it that way as part of a broader
defense in depth policy

At any rate, none of the other 3000+ ports i build for my organization try to
invoke any executable from ${DISTDIR} and I think we just might be able to
agree that none should.

So, upon investigating this case, I have determined the executable in question
to effectively be one big NOOP. The attached patch merely adds --no-checkout to
the `git clone` operation (in its short form, -n) to bypass the error
altogether while creating an identical tarball. Admittedly, this quick fix
renders the construct being used by the pre-fetch target here to be less robust
and flexible in the face of hypothetical future updates to the origin
distribution repository.

I like the method and practice the pre-fetch construct in this port employs to
create a reproducible distfile. If it is known by anyone reading to be a useful
or common construct I would be happy to further investigate or participate in
deciding/writing a more robust and generic solution.

===>  Cleaning for oidn-2.1.0
===>  License APACHE20 accepted by the user
==> Fetching the oidn/weights subproject with large LFS files
Downloading rt_alb.tza (1.8 MB)
Downloading rt_hdr.tza (1.8 MB)
Downloading rt_hdr_alb.tza (1.8 MB)
Downloading rt_hdr_alb_nrm.tza (1.8 MB)
Downloading rt_hdr_calb_cnrm.tza (1.8 MB)
Downloading rt_ldr.tza (1.8 MB)
Downloading rt_ldr_alb.tza (1.8 MB)
Downloading rt_ldr_alb_nrm.tza (1.8 MB)
Downloading rt_ldr_calb_cnrm.tza (1.8 MB)
Downloading rt_nrm.tza (1.8 MB)
Downloading rtlightmap_dir.tza (1.8 MB)
Downloading rtlightmap_hdr.tza (1.8 MB)
fatal: cannot exec
'/usr/ports/distfiles/oidn-weights-4322c25e25a05584f65da1a4be5cef40a4b2e90b/.git/hooks/post-checkout':
Permission denied
*** Error code 1

Stop.
make: stopped in /usr/ports/graphics/oidn
root@matrix:~ # mount|grep distfiles
neo/os/FreeBSD/ports/distfiles on /usr/ports/distfiles (zfs, local, noatime,
noexec, nosuid, nfsv4acls)
root@matrix:~ #

-- 
You are receiving this mail because:
You are the assignee for the bug.