From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp10.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id QKvJJ9y/DGOHLgEAbAwnHQ (envelope-from ) for ; Mon, 29 Aug 2022 15:32:12 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp10.migadu.com with LMTPS id IHa2Jty/DGPXPAEAG6o9tA (envelope-from ) for ; Mon, 29 Aug 2022 15:32:12 +0200 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 3193F359AE for ; Mon, 29 Aug 2022 15:32:12 +0200 (CEST) Received: from localhost ([::1]:55590 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oSes7-0006oa-7t for larch@yhetil.org; Mon, 29 Aug 2022 09:32:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:45198) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oSery-0006ni-51 for bug-guix@gnu.org; Mon, 29 Aug 2022 09:32:05 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:42431) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oSerx-0008NV-S2 for bug-guix@gnu.org; Mon, 29 Aug 2022 09:32:01 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1oSerx-0008Ug-NZ for bug-guix@gnu.org; Mon, 29 Aug 2022 09:32:01 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#56444: [EXT] Re: [EXT] Re: bug#56444: Patch to fix Gitolite home directory permissions Resent-From: "Thompson, David" Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 29 Aug 2022 13:32:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 56444 X-GNU-PR-Package: guix X-GNU-PR-Keywords: To: Maxime Devos Cc: 56444@debbugs.gnu.org Received: via spool by 56444-submit@debbugs.gnu.org id=B56444.166177987832600 (code B ref 56444); Mon, 29 Aug 2022 13:32:01 +0000 Received: (at 56444) by debbugs.gnu.org; 29 Aug 2022 13:31:18 +0000 Received: from localhost ([127.0.0.1]:60413 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oSerF-0008Tk-B6 for submit@debbugs.gnu.org; Mon, 29 Aug 2022 09:31:17 -0400 Received: from mail-lf1-f45.google.com ([209.85.167.45]:33531) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oSerD-0008TV-QI for 56444@debbugs.gnu.org; Mon, 29 Aug 2022 09:31:16 -0400 Received: by mail-lf1-f45.google.com with SMTP id br21so5398347lfb.0 for <56444@debbugs.gnu.org>; Mon, 29 Aug 2022 06:31:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=worcester-edu.20210112.gappssmtp.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc; bh=cEgIJHmA9V0b0+Q4pr8vB2ZuUfDX8GL1P9hzxLOKG0Y=; b=sX/fjT0jfT58dbEAj4HlPPpGRvws1qexLx3OJvprjtU8swFuBeVgoCjKYIUiSg09Cs BZ6scz9tuAXwTedhJmUTaBOy2Y1AD5UZrIgkDQsmMlM5S/VdUFhyTa5aHTvVzUoSE5Zh CGT4c4M9BTC7MQ19h7z16a5zHgwK5LS9zO6iJBtCc43LSpRiPtDSJpSceEyf2m9804l6 TjxqOaYfvS4rsKXnkwK0R3+Mjyt1aFoP/fzcwsB0pxs182JXqsBeMCgJ0jitcmtzVzCz Cj4Gfut0nX/OIpk+flfxuGNa+f15cHZAEDWfUIEe/G6gRIVNgcFMSVkP+3JNvYrvdBoi /lXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc; bh=cEgIJHmA9V0b0+Q4pr8vB2ZuUfDX8GL1P9hzxLOKG0Y=; b=o7kfJithyZG4swR6tc8qzk/hVvIM44RGzeOeJDEGvgtl70uVgwRv4wYz9SsjuhZWts yAuPdkwllB8haOmYFGRruFSjoGtw/PCPXqfV2rThDDaePSWddm0G/Og2qGyyswWFDajf r1XOe/L10X40cIaBJOeRgdBxs+B1y90D3DmARE/XdqfWCbfnDXzlixe5N+GQJTUTlPPZ obZMndMwThDiC0L0miKjAc3+7z/etog9FdjHMBtumzztF5AsGp3cFN8c95tQV46dsKGL DZEvmHCAAOgkUyhMqd/oWeGbH3LByrPAhz6Qq1cK/oknluQvS8msdvGqp2JuQ8CyihWa 4pYg== X-Gm-Message-State: ACgBeo34WRUBYSrY0Tk0xlnS6gym+dtAG3UQDbLcb7fgP9hfmn2dYwd2 ir57qBKhelSqMSkd1bdXj22aLhM/UcCGOw+HfSWjDQ== X-Google-Smtp-Source: AA6agR7rOAyzuUoamebtO0PBcSStABLmQnMfPtYL4ni4rtvS0LgKwaN3mfJn8B7UtPmIonpPtdCFmldu/lrwZPi2FxI= X-Received: by 2002:ac2:5e8c:0:b0:494:6d14:f16e with SMTP id b12-20020ac25e8c000000b004946d14f16emr1414072lfq.316.1661779869644; Mon, 29 Aug 2022 06:31:09 -0700 (PDT) MIME-Version: 1.0 References: <87zghkehdd.fsf@pisemsky.com> <1967478a-3d68-a0c7-3a87-49762502232b@telenet.be> <31e8c6df-a9c9-7f16-69fb-e022d94c16ff@telenet.be> In-Reply-To: <31e8c6df-a9c9-7f16-69fb-e022d94c16ff@telenet.be> From: "Thompson, David" Date: Mon, 29 Aug 2022 09:30:58 -0400 Message-ID: Content-Type: multipart/alternative; boundary="000000000000d35cde05e76146f3" X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Migadu-Flow: FLOW_IN X-Migadu-To: larch@yhetil.org X-Migadu-Country: US ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1661779932; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:resent-cc:resent-from:resent-sender: resent-message-id:in-reply-to:in-reply-to:references:references: list-id:list-help:list-unsubscribe:list-subscribe:list-post: dkim-signature; bh=cEgIJHmA9V0b0+Q4pr8vB2ZuUfDX8GL1P9hzxLOKG0Y=; b=hozLKtxgxfxIOrS08wpwy4K13iDwx3G8VsPzY667phMkcgTaEiqDheqVTqJyrD/GLrdOiY Hiq6M4Df3RICr5xxFsK4YZ/1f5nxhjtX7rRKx8BVRuzq7Ub2LAl+O0SL/VYyBERKWuyuyD wmhHlFdaSNCuZ77QJagZ14bOdkTS20QAgNQhkXfPSmUXBz+pV4sOL8azwv+s/3kzEmtNBm wYH9M3AobzGjXCbf74fAbyrDJttiIcAeSgwivUmOiui2GfZtFvN1gi8Hv8hyK5u1D+p/dc ivUV0qI9g6aUGlFBuTarpG1nRAXLEoRdbqVO2rZ2W25iNK6N6SGu+oYaKx/wKA== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1661779932; a=rsa-sha256; cv=none; b=ShHeaMcGW1bAqSMhuQPoPnVHWBPKy/1biWZ3tXqhob3gBoJHh8PCuU8YjolTTQae2WUdpf Em4ihqsdJVSybwwiS+Ctif4rakMPhJDXxr5FPa7+a//IjqNEZMzDh+PNWepV+NtZ44xCww TRpbz+MSC+ZiM/6HLl5qjsCkTNen0A5u4lR3Wi0Fn4NsmHSKNcHjMJt8Q2K78rY0TRAg2V QRBdZcTzGU8Lx+US+Dj1qnXR9dndYhIEUxnq3wxewr2JscnBjFQstBxKrDtqboUDHmkX2v hqspQkSmzrHAjVpdq32D6MeXUxKvow55Q4ifEQw04VgY+VEePrtsr6DSIyrX0w== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=worcester-edu.20210112.gappssmtp.com header.s=20210112 header.b="sX/fjT0j"; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "bug-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="bug-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Spam-Score: 0.10 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=worcester-edu.20210112.gappssmtp.com header.s=20210112 header.b="sX/fjT0j"; dmarc=none; spf=pass (aspmx1.migadu.com: domain of "bug-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="bug-guix-bounces+larch=yhetil.org@gnu.org" X-Migadu-Queue-Id: 3193F359AE X-Spam-Score: 0.10 X-Migadu-Scanner: scn0.migadu.com X-TUID: yA9NOXykf9wm --000000000000d35cde05e76146f3 Content-Type: text/plain; charset="UTF-8" On Mon, Aug 29, 2022 at 9:19 AM Maxime Devos wrote: > On 29-08-2022 14:57, Thompson, David wrote: > > > I disagree. I believe we shouldn't let perfect be the enemy of the good. > > I don't think your patch counts as "good" here -- while fixing the bug > counts as "good", you are at the same time introducing a new bug (the > non-atomicity), which is bad. You would have to weigh the goodness and > the badness to end up with an overall "good" (or maybe "bad", depending > on the conclusion), but I'd think that the time required to do such a > weighing is better spent by doing a tiny bit of extra effort to > implement the new field (it should be very low effort, see other response). > My patch has a very limited scope of only changing the gitolite service. Your proposal has a much greater scope of modifying a core structure used for system configuration. The new bug you mention is only bad in a theoretical sense. In practice, the permission bits are misconfigured for a blip of time during system reconfiguration, which is a lot better than being misconfigured all the time which is the status quo. It's the difference between a gitolite that works nicely with cgit/gitweb and one that doesn't. I agree that it's a good goal to improve atomicity and I think making more general to allow for different permission bits on the home directory is a good idea, but I see it as one step removed from fixing this particular bug. My patch follows the recommended approach outlined in a comment in (gnu build activation) written by Ludovic in 2019: ;; Always set ownership and permissions for home directories of system ;; accounts. If a service needs looser permissions on its home ;; directories, it can always chmod it in an activation snippet. - Dave --000000000000d35cde05e76146f3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Mon, Aug 29, 2022 at 9:19 AM Maxime Devos <maximedevos@telenet.be> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">On 29-08-2022 14:57, Thomp= son, David wrote:

> I disagree.=C2=A0 I believe we shouldn't let perfect be the enemy = of the good.

I don't think your patch counts as "good" here -- while fixin= g the bug
counts as "good", you are at the same time introducing a new bug = (the
non-atomicity), which is bad.=C2=A0 You would have to weigh the goodness an= d
the badness to end up with an overall "good" (or maybe "bad&= quot;, depending
on the conclusion), but I'd think that the time required to do such a <= br> weighing is better spent by doing a tiny bit of extra effort to
implement the new field (it should be very low effort, see other response).=

My patch has a very limited scope of o= nly changing the gitolite service.=C2=A0 Your proposal has a much greater s= cope of modifying a core structure used for system configuration.=C2=A0 The= new bug you mention is only bad in a theoretical sense.=C2=A0 In practice,= the permission bits are misconfigured for a blip of time during system rec= onfiguration, which is a lot better than being misconfigured all the time w= hich is the status quo.=C2=A0 It's the difference between a gitolite th= at works nicely with cgit/gitweb and one that doesn't. I agree that it&= #39;s a good goal to improve atomicity and I think making <user-account&= gt; more general to allow for different permission bits on the home directo= ry is a good idea, but I see it as one step removed from fixing this partic= ular bug.=C2=A0 My patch follows the recommended approach outlined in a com= ment in (gnu build activation) written by Ludovic in 2019:

=C2=A0 =C2=A0 =C2=A0 ;; Always set ownership and permissions for h= ome directories of system
=C2=A0 =C2=A0 =C2=A0 ;; accounts.=C2=A0 If a s= ervice needs looser permissions on its home
=C2=A0 =C2=A0 =C2=A0 ;; dire= ctories, it can always chmod it in an activation snippet.
- Dave
--000000000000d35cde05e76146f3--