• Re: booststrapping /usr-merged systems (was: Re: DEP 17: Improve suppor

    From G. Branden Robinson@1:229/2 to Helmut Grohne on Wed May 17 11:50:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    At 2023-05-17T11:30:36+0200, Helmut Grohne wrote:
    This bootstrap aspect got me and I discussed this with a number of
    people and did some research.

    I'd like to nominate you for a Russ Allbery Award for the most useful
    post to the thread. Your attention to concrete, empirical details,
    arising necessarily from practical experimentation rather than pure
    cogitation, made the nature of the problems here clearly comprehensible
    to me. And if I was befogged, I'll wager other people were too.

    Regards,
    Branden

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCAAdFiEEh3PWHWjjDgcrENwa0Z6cfXEmbc4FAmRkoaEACgkQ0Z6cfXEm bc62cg//dya/GMrE5ZNQZxw66Z8exNUVe++Tc4vBL//yIXQQJ9GFx/zI6CfL+fKt uG3Eh2JrfMVdhJ0pKfneiYfJw8FNgW9XX1W4EjO9eQiRFn0/FXujoIFV7rsfkGHf yOCe2CHSytKFfRf4NmMkI8imGnNwZtFwPVp6+u6QLUKHOIVYrs7hp/rpPeCsmHmZ pgGjy+F2ei3b0ZT1+oa2EXi6Y2H20mEXAQH0ZeU80Sd4I7y1Ejt9ysH3mFM3/ySD 4DhXEkdwBpcc9A6Z71ab2Dunro7Dm5mI3cg4q4wS8MELovUJj3v61SZjtuJ/8II7 I0We+xX38dDVWQ4LKmpUjg7BR6Ey5SF6bHB7B9r3WgBKSFiZVJOvnjq0y5GaPFQC N4D4MZPsT9X4CSWx42VH6KZWdRs94mesdG/OIvlj3rrtnV8MlDxzLeje/rH7OUzh NCB/iV3goHd03EC8MYbKISoA8rMTKw9BS+ojtcD4QMkekvfGJPO+T7DSM+SmiQ8s ob/mz3TxfetILrFHH+/L3ZRvRCqjVs601hb9yeYLn4VhrPC8b4Fzm3uPbpi3KOWX +Z8U0maEN3wSvOJM1jsT4hJFLIkqg91LHZ4AEFFHsFblk34GOI+d490ZX9uszvYD OMKz6KhJWRoIRAKti4UL/EfvVtxHsAvDS+xXFprDPi47YmKkK6k=
    =yrrl
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Marco d'Itri@1:229/2 to Helmut Grohne on Wed May 17 12:20:02 2023
    XPost: linux.debian.devel
    From: [email protected]

    On May 17, Helmut Grohne <[email protected]> wrote:

    Given the feedback, I am convinced that changing PT_INTERP is a stupid
    idea regardless of whether it is technically feasible. There must be a
    better way. Let's step back a bit.
    Me too, I was never persuaded.

    4. Change the bootstrap protocol. In essence, this has been attempted
    in debootstrap by creating these symlinks prior to unpack, but no
    consensus has evolved around this approach yet. The category is
    wider though and generally requires changes to all bootstrapping
    tools.
    I think that this is being dismissed too easily, mostly because the
    mmdebstrap maintainer has been fighting it due to a philosophical
    preference.

    Moving on to category 4 feels rather obvious, especially because work
    has been done there in debootstrap. The approach in debootstrap however
    is one that I see as a dead end, because it causes us to maintain this
    code multiple times. It's the number of derivatives times the number of bootstrap tools and that doesn't scale.
    But the code is trivial. It is currently more complex than it is needed
    in debootstrap only because initially it needed to support the biarch
    libc packages, but since nowadays they create the top level symlinks themselves then it can be made as simple as:

    for dir in bin sbin lib; do
    ln -s usr/"$dir" "$TARGET/$dir"
    mkdir -p "$TARGET/usr/$dir"
    done

    Indeed, usrmerge does not have any architecture-specific knowledge
    anymore.

    https://wiki.debian.org/Teams/Dpkg/Spec/InstallBootstrap. In particular, making architecture bootstrap become chrootless would likely be a
    generic solution to this and other problems. However, any change needs
    to propagate to a stable release in all bootstrapping tools. Therefore
    we cannot reasonably finish the transition before forky. This makes
    Why not?

    So what's left is category 1. I looked into what the minimum set of
    files to be retained could be. To do that end, I moved everything and
    then reverted as much as was needed to make bootstrapping work.
    * /lib64/ld-linux-x86-64.so.2 (hopefully obvious)
    * /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 (link target)
    * /bin/sh (hopefully obvious)
    * /bin/dash (link target)
    Interesting approach. If it is so much simple, why are you not persuaded
    that it could be a good solution until the bootstrapping tools are
    updated?

    * /bin/bash (usrmerge runs ldd, which is a #!/bin/bash script)
    * /bin/more (update-alternatives doesn't like its absence)
    * /bin/cp (unless usrmerge stops hard coding its path)
    These can be easily fixed, maybe the ldd issue too.

    The other major takeaway is that a significant
    chunk of the problems mentioned in this mail cannot be fixed by
    modifying dpkg only.
    Agreed.

    --
    ciao,
    Marco

    -----BEGIN PGP SIGNATURE-----

    iHUEABYIAB0WIQQnKUXNg20437dCfobLPsM64d7XgQUCZGSpXAAKCRDLPsM64d7X gRH6AP0eP7sjTiCmppDpmpVwmiwodb0aF/sH94EkCIFbATHx8wD/WFjsl2gCn7Al KSQ3zb3E7ToCv933/CTwXC+uDyHooA4=
    =B65+
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Sam Hartman@1:229/2 to All on Wed May 17 19:20:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    "Helmut" == Helmut Grohne <[email protected]> writes:

    Helmut> I think at this point, we have quite universal consensus
    Helmut> about the goal of moving files to their canonical location
    Helmut> (i.e. from / to /usr) as a solution to the aliasing problems
    Helmut> while we do not have consensus on precisely how to do this
    Helmut> (i.e. with changing dpkg or without). If you believe that
    Helmut> this is not consensus, please speak up.

    I agree we have strong consensus that we want to move files to their
    canonical locations.

    I'm not entirely sure I'd agree that we have consensus that's our
    solution to the aliasing problem.
    there are other competing reasons why we might want to move files to
    their canonical locations.

    If for example we accomplish the move to canonical locations by changing
    dpkg, we might well get some form of aliasing support in dpkg.

    This mostly doesn't matter.
    If we're going to move files to their canonical location, it doesn't
    matter much why.
    There is one potential area where it might.

    If the reason for preferring one bootstrap protocol over another depends
    on why we're moving files to their canonical locations, I think we'd
    need to dig into that very carefully and examine that part of your
    consensus call a bit more.

    -----BEGIN PGP SIGNATURE-----

    iHUEARYIAB0WIQSj2jRwbAdKzGY/4uAsbEw8qDeGdAUCZGULowAKCRAsbEw8qDeG dDxXAP4rENLEWtNAp8dhmNMgORZ1gwObsoZW0M4qc2g+mPJvPQEAxuSFU1i9Yp3q W+e5RsjrOKtO6gKwRaYcYwCOo48xvAk=
    =wnWX
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Sam Hartman@1:229/2 to All on Wed May 17 19:30:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    "Helmut" == Helmut Grohne <[email protected]> writes:

    Helmut> Moving on to category 4 feels rather obvious, especially
    Helmut> because work has been done there in debootstrap. The
    Helmut> approach in debootstrap however is one that I see as a dead
    Helmut> end, because it causes us to maintain this code multiple
    Helmut> times. It's the number of derivatives times the number of
    Helmut> bootstrap tools and that doesn't scale.

    Like others, I don't find this analysis compelling.
    I'd like to better understand why the number of derivatives is in the
    cross product.
    I suspect most derivatives are going to move to merged /usr, and so I
    suspect most if not all derivatives can be treated the same.

    What am I missing?

    -----BEGIN PGP SIGNATURE-----

    iHUEARYIAB0WIQSj2jRwbAdKzGY/4uAsbEw8qDeGdAUCZGUNCwAKCRAsbEw8qDeG dNASAQD9dRi+6NM6NL///fXVp6kAe0K7nocXcH+C9tJcoBCr0gD7B+B2Yu0RtQAi uUnZoaPIV8eF41yu77r413b3HyGwOAQ=
    =dm1s
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Luca Boccassi@1:229/2 to Helmut Grohne on Wed May 17 12:30:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Wed, 17 May 2023 at 10:31, Helmut Grohne <[email protected]> wrote:

    Hi,

    This bootstrap aspect got me and I discussed this with a number of
    people and did some research.

    On Sun, May 07, 2023 at 12:51:21PM +0100, Luca Boccassi wrote:
    I don't think this is true? At least not in the broader sense: if you compile something on Debian, it will obviously get linked against
    libraries and dependencies as they are in Debian.
    Perhaps what you mean is that, given an entire separate sysroot-like
    tree, passing the appropriate compiler and linker flags and
    environment variables, you can use the local compiler we ship to build 'foreign' programs. That is true, but again it requires to set up the environment appropriately, including linker flags. And the caller
    needs to ensure the environment, including linker flags, is
    appropriate for the target environment (I guess 'host' environment, in
    GNU parlance). Therefore, I don't think it would be unreasonable to
    require that if the target environment is split-usr, then the caller
    also needs to specify an appropriate '-Wl,--dynamic-linker=/lib/ld-whatever' option.

    Given the feedback, I am convinced that changing PT_INTERP is a stupid
    idea regardless of whether it is technically feasible. There must be a
    better way. Let's step back a bit.

    The underlying problem here is performing the initial filesystem
    bootstrap. The semantics of this are a bit vague as they are not spelled
    out in policy, so we will have to derive them from implementations.

    I think the major players are (in descending popularity):
    * debootstrap
    * mmdebstrap
    * cdebootstrap
    * multistrap

    multistrap predates mmdebstrap and when there was no mmdebstrap, I used
    it a lot. When attempting to test it, I totally couldn't convince it to bootstrap from an unsigned or locally signed repository. The patch in #908451 didn't cut it. I also note that it creates a /lib64 -> /lib
    symbolic link which feels quite incompatible with merged-/usr. For
    these reasons, I am dropping multistrap from the tools under
    consideration and recommend removing it from the archive. If you happen
    to use multistrap, now would be a good moment to tell me. Personally,
    all of my use cases of multistrap have been converted to mmdebstrap and
    that made a lot of things simpler.

    cdebootstrap vaguely works though unsigned operation seems dysfunctional
    as it runs apt-get update during cdebootstrap-helper-apt.postinst and
    that fails. I happen to not have figured out why and treat this failure
    as a success.

    So the most popular implementations quite evidently are debootstrap and mmdebstrap and both "just work". I note though that they work quite differently:
    * debootstrap (depending on flags including --variant) pre-merges its
    chroot while mmdebstrap relies on packages doing it.

    I think that the question whether a distribution is merged is a
    property of the distribution and not the bootstrap tool, so I
    strongly recommend following mmdebstrap's view on this. The
    debootstrap way means that we have to include patches for every
    derivative, which is a process that does not scale well.

    * mmdebstrap operates in two phases. It first unpacks and configures a
    rather minimal set of packages and then proceeds to adding packages
    passed to --include in a second phase once essential is fully
    configured while debootstrap immediately unpacks everything.

    I think the debootstrap approach is slightly worse here, because it
    means that preinst scripts of non-essential packages cannot rely on
    essential packages having been configured.

    In any case, we have to deal with both behaviours.

    After this little excursion into bootstrap technology, let's go back to
    the /usr-merge and its effects.

    I think at this point, we have quite universal consensus about the goal
    of moving files to their canonical location (i.e. from / to /usr) as a solution to the aliasing problems while we do not have consensus on
    precisely how to do this (i.e. with changing dpkg or without). If you
    believe that this is not consensus, please speak up.

    So in a distant future our packages will not contain any files in /bin
    or /lib. In particular, this affects /bin/sh and the dynamic loader,
    both of which are required to run maintainer scripts, which are
    currently required for creating the symbolic links. Boom.


    [continued in next message]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Luca Boccassi@1:229/2 to Simon Richter on Fri May 19 13:10:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Fri, 19 May 2023 at 01:30, Simon Richter <[email protected]> wrote:

    Hi,

    On 5/18/23 18:08, Luca Boccassi wrote:

    Without it, leaving them in place makes no difference for usrmerged
    systems, and allows derived distributions that don't need usrmerge to
    continue using our packages.

    Not quite. Having packages only ship files under /usr (and possibly
    /etc) is very much a goal in itself for a lot of us.

    My point is: that is not an end goal, because it provides no real
    tangible benefit on its own.

    For yourself. Again, for others, it is and it does.

    It does make sense in the context of building immutable images, which is *also* a bootstrapping problem, and probably worth being supported with proper tooling.

    - there is no guarantee that usrmerge will be permanent or the last
    transition of this kind

    It is permanent, there are several upstream projects that will drop
    support for legacy layouts very soon, and it will not be re-added
    back.

    You are currently building a "legacy" system, it will just take a bit of
    time to reach that status. The less you anticipate future needs, the
    faster this will be.

    I understand that you are also a member of one of these upstream
    projects, and that you are taking the interests of this project to
    "pretty much the last relevant holdout" here. Has it occurred to you
    that you are also wearing a Debian hat, and you could be taking the
    interests of the Debian project to said upstream project?

    Has it occurred to you that there might be a specific reason why said
    upstream project has kept compatibility with legacy cruft that only
    benefits Debian for so many years, at non-zero cost for developers,
    despite everything else that's relevant having long since moved on? It
    is really not difficult to find out what that reason might be, and
    would have been better to do so before throwing around such
    accusations. And if you can't find it, you can always go to one of the
    numerous available channels and ask other maintainers. Why don't you
    do that, ask how come support for Debian stable for this and many
    other aspects is kept intact and who's behind that effort, and report
    back the answer?

    - it also solves the bootstrap problem

    It also is the least likely to succeed, and the most likely to cause significant "social" upheavals.

    The only social problem I see is that you are trying to create a
    situation in which other people are compelled to do your work for you if
    they want it to be done properly.

    No, the social problem is that there is one maintainer who is allowed
    to ignore the TC and roadblock the entire distribution, so that
    something that's been trivially and quickly done pretty much literally everywhere else is instead made incredibly difficult and long-winded.
    But despite that, we are getting there, slow and steady, and
    remarkably well given the difficult circumstances outwith our control.

    So far, you have been throwing out "solutions", and left the analysis of
    the feasibility of those to other people, then, after three iterations,
    you demanded a full write-up of all existing use cases and blanket
    permission to ignore anything not brought up in this list.

    I have literally no idea what you are talking about. I have
    contributed what I can in my spare time, unblocking the transition
    last year and helping out Helmut and others this year. This is not my
    day job, by the way. What have you done to help, precisely?

    The thing is: I see more enthusiasm and self-directed problem solving
    skills from the interns at the company where I work, and at the same
    time you are one of the top contributors of the upstream project whose
    ideas of a "supported" configuration we are supposed to follow.

    I seriously do not appreciate your tone, you are out of line. Please stop.

    Kind regards,
    Luca Boccassi

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Luca Boccassi@1:229/2 to Simon Richter on Thu May 18 11:30:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Thu, 18 May 2023 at 07:39, Simon Richter <[email protected]> wrote:

    Hi,

    On 5/18/23 02:15, Sam Hartman wrote:

    Helmut> I think at this point, we have quite universal consensus
    Helmut> about the goal of moving files to their canonical location
    Helmut> (i.e. from / to /usr) as a solution to the aliasing problems
    Helmut> while we do not have consensus on precisely how to do this
    Helmut> (i.e. with changing dpkg or without). If you believe that
    Helmut> this is not consensus, please speak up.

    I agree we have strong consensus that we want to move files to their canonical locations.

    I'm not entirely sure I'd agree that we have consensus that's our
    solution to the aliasing problem.

    It's the other way around: moving the files as a solution to the
    aliasing problem is the strongest argument in favour of moving the files inside the packages.

    Without it, leaving them in place makes no difference for usrmerged
    systems, and allows derived distributions that don't need usrmerge to continue using our packages.

    Not quite. Having packages only ship files under /usr (and possibly
    /etc) is very much a goal in itself for a lot of us.

    If for example we accomplish the move to canonical locations by changing dpkg, we might well get some form of aliasing support in dpkg.

    IMO, that is still the preferred solution:

    - it is actually safe, because dpkg knows what is going on and can
    reject conflicting changes
    - there is no guarantee that usrmerge will be permanent or the last transition of this kind

    It is permanent, there are several upstream projects that will drop
    support for legacy layouts very soon, and it will not be re-added
    back. This will become more and more common, as simply most will stop
    caring and paying any attention to this detail. Debian is pretty much
    the last relevant holdout here, and that's going to end in a couple of
    weeks.

    - it also solves the bootstrap problem

    It also is the least likely to succeed, and the most likely to cause significant "social" upheavals.

    Kind regards,
    Luca Boccassi

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Simon Richter@1:229/2 to Sam Hartman on Thu May 18 08:40:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi,

    On 5/18/23 02:15, Sam Hartman wrote:

    Helmut> I think at this point, we have quite universal consensus
    Helmut> about the goal of moving files to their canonical location
    Helmut> (i.e. from / to /usr) as a solution to the aliasing problems
    Helmut> while we do not have consensus on precisely how to do this
    Helmut> (i.e. with changing dpkg or without). If you believe that
    Helmut> this is not consensus, please speak up.

    I agree we have strong consensus that we want to move files to their canonical locations.

    I'm not entirely sure I'd agree that we have consensus that's our
    solution to the aliasing problem.

    It's the other way around: moving the files as a solution to the
    aliasing problem is the strongest argument in favour of moving the files
    inside the packages.

    Without it, leaving them in place makes no difference for usrmerged
    systems, and allows derived distributions that don't need usrmerge to
    continue using our packages.

    If for example we accomplish the move to canonical locations by changing dpkg, we might well get some form of aliasing support in dpkg.

    IMO, that is still the preferred solution:

    - it is actually safe, because dpkg knows what is going on and can
    reject conflicting changes
    - there is no guarantee that usrmerge will be permanent or the last transition of this kind
    - it also solves the bootstrap problem

    Simon

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Simon Richter@1:229/2 to Luca Boccassi on Fri May 19 02:40:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi,

    On 5/18/23 18:08, Luca Boccassi wrote:

    Without it, leaving them in place makes no difference for usrmerged
    systems, and allows derived distributions that don't need usrmerge to
    continue using our packages.

    Not quite. Having packages only ship files under /usr (and possibly
    /etc) is very much a goal in itself for a lot of us.

    My point is: that is not an end goal, because it provides no real
    tangible benefit on its own.

    It does make sense in the context of building immutable images, which is
    *also* a bootstrapping problem, and probably worth being supported with
    proper tooling.

    - there is no guarantee that usrmerge will be permanent or the last
    transition of this kind

    It is permanent, there are several upstream projects that will drop
    support for legacy layouts very soon, and it will not be re-added
    back.

    You are currently building a "legacy" system, it will just take a bit of
    time to reach that status. The less you anticipate future needs, the
    faster this will be.

    I understand that you are also a member of one of these upstream
    projects, and that you are taking the interests of this project to
    "pretty much the last relevant holdout" here. Has it occurred to you
    that you are also wearing a Debian hat, and you could be taking the
    interests of the Debian project to said upstream project?

    - it also solves the bootstrap problem

    It also is the least likely to succeed, and the most likely to cause significant "social" upheavals.

    The only social problem I see is that you are trying to create a
    situation in which other people are compelled to do your work for you if
    they want it to be done properly.

    So far, you have been throwing out "solutions", and left the analysis of
    the feasibility of those to other people, then, after three iterations,
    you demanded a full write-up of all existing use cases and blanket
    permission to ignore anything not brought up in this list.

    The thing is: I see more enthusiasm and self-directed problem solving
    skills from the interns at the company where I work, and at the same
    time you are one of the top contributors of the upstream project whose
    ideas of a "supported" configuration we are supposed to follow.

    Simon

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Luca Boccassi@1:229/2 to Raphael Hertzog on Thu Jun 8 12:10:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Thu, 8 Jun 2023 at 09:46, Raphael Hertzog <[email protected]> wrote:

    Hi,

    On Wed, 17 May 2023, Helmut Grohne wrote:
    For completeness sake, there is one more entry in category 3: We can run the dynamic loader from its canonical location explicitly, so we'd
    modify maintainer scripts to start with:

    #!/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /usr/bin/sh

    This would only affect preinst scripts participating in bootstrap and
    we'd not bother with changing PT_INTERP in the toolchain nor in
    packages. Unfortunately, this completely breaks the DPKG_ROOT work and
    with that, I see no viable entries in category 3 for moving forward.

    Moving on to category 4 feels rather obvious, especially because work
    has been done there in debootstrap. The approach in debootstrap however
    is one that I see as a dead end, because it causes us to maintain this
    code multiple times. It's the number of derivatives times the number of bootstrap tools and that doesn't scale.

    Category 4 is wider though and we also have other prior art at https://wiki.debian.org/Teams/Dpkg/Spec/InstallBootstrap. In particular, making architecture bootstrap become chrootless would likely be a
    generic solution to this and other problems. However, any change needs
    to propagate to a stable release in all bootstrapping tools. Therefore
    we cannot reasonably finish the transition before forky. This makes category 4 rather unattractive in a short term, but still worth pursuing
    in a long term.

    In the same spirit, I'd like to throw an idea... could we decide that base-files is the first package to be configured as part of the bootstrap protocol and change base-files maintainer's scripts into statically linked executables so that they can work even if we don't have the library loader
    on the ABI-compliant path?

    And creating the required symlinks would be done by those (standalone) maintainer scripts...

    I don't know if we already have some rule/invariant in the configuration order of the unpacked packages, but I doubt so.

    Having ruled out categories 3 and 4 maybe category 2 would be good? We could just ship those symlinks in base-files and be done, right? Unfortunately, we pass -k to tar in debootstrap, so when it extracts base-files and tries to unpack the bin -> usr/bin symlink, it sees that
    oh no, there already is a symlink at bin (as debootstrap placed it
    there) and thus fails. So in order to make this work, we also have to modify debootstrap (and thus are in a combination of category 3 and 4).

    So when we will have fixed this, and waited for a release cycle, we can
    get rid of the statically compiled maintainer scripts and simply ship the symlinks in base-files.

    Just a note that we can always change debootstrap via bookworm-p-u,
    we've already done so in the past for this, so there's no requirement
    to wait an extra release.

    Kind regards,
    Luca Boccassi

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Raphael Hertzog@1:229/2 to Helmut Grohne on Thu Jun 8 10:50:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi,

    On Wed, 17 May 2023, Helmut Grohne wrote:
    For completeness sake, there is one more entry in category 3: We can run
    the dynamic loader from its canonical location explicitly, so we'd
    modify maintainer scripts to start with:

    #!/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /usr/bin/sh

    This would only affect preinst scripts participating in bootstrap and
    we'd not bother with changing PT_INTERP in the toolchain nor in
    packages. Unfortunately, this completely breaks the DPKG_ROOT work and
    with that, I see no viable entries in category 3 for moving forward.

    Moving on to category 4 feels rather obvious, especially because work
    has been done there in debootstrap. The approach in debootstrap however
    is one that I see as a dead end, because it causes us to maintain this
    code multiple times. It's the number of derivatives times the number of bootstrap tools and that doesn't scale.

    Category 4 is wider though and we also have other prior art at https://wiki.debian.org/Teams/Dpkg/Spec/InstallBootstrap. In particular, making architecture bootstrap become chrootless would likely be a
    generic solution to this and other problems. However, any change needs
    to propagate to a stable release in all bootstrapping tools. Therefore
    we cannot reasonably finish the transition before forky. This makes
    category 4 rather unattractive in a short term, but still worth pursuing
    in a long term.

    In the same spirit, I'd like to throw an idea... could we decide that base-files is the first package to be configured as part of the bootstrap protocol and change base-files maintainer's scripts into statically linked executables so that they can work even if we don't have the library loader
    on the ABI-compliant path?

    And creating the required symlinks would be done by those (standalone) maintainer scripts...

    I don't know if we already have some rule/invariant in the configuration
    order of the unpacked packages, but I doubt so.

    Having ruled out categories 3 and 4 maybe category 2 would be good? We
    could just ship those symlinks in base-files and be done, right? Unfortunately, we pass -k to tar in debootstrap, so when it extracts base-files and tries to unpack the bin -> usr/bin symlink, it sees that
    oh no, there already is a symlink at bin (as debootstrap placed it
    there) and thus fails. So in order to make this work, we also have to
    modify debootstrap (and thus are in a combination of category 3 and 4).

    So when we will have fixed this, and waited for a release cycle, we can
    get rid of the statically compiled maintainer scripts and simply ship the symlinks in base-files.

    Cheers,
    --
    ⢀⣴⠾⠻⢶⣦⠀ Raphaël Hertzog <[email protected]>
    ⣾⠁⢠⠒⠀⣿⡁
    ⢿⡄⠘⠷⠚⠋ The Debian Handbook: https://debian-handbook.info/get/
    ⠈⠳⣄⠀⠀⠀⠀ Debian Long Term Support: https://deb.li/LTS

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Marco d'Itri@1:229/2 to Raphael Hertzog on Fri Jun 9 09:50:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Jun 08, Raphael Hertzog <[email protected]> wrote:

    In the same spirit, I'd like to throw an idea... could we decide that base-files is the first package to be configured as part of the bootstrap protocol and change base-files maintainer's scripts into statically linked executables so that they can work even if we don't have the library loader
    on the ABI-compliant path?
    It could be even easier: base-files could be unpacked once without
    running the maintainer scripts and then "reinstalled" again later as
    usual.

    And creating the required symlinks would be done by those (standalone) maintainer scripts...

    I don't know if we already have some rule/invariant in the configuration order of the unpacked packages, but I doubt so.
    Indeed, this would be very simple and it has already been proposed.
    But somebody then complained that special-casing a package would violate
    the design contraints he self-imposed to his own image building tool,
    and as we all know every Debian maintainer can veto any systemic changes
    that they do not like.

    --
    ciao,
    Marco

    -----BEGIN PGP SIGNATURE-----

    iHUEABYIAB0WIQQnKUXNg20437dCfobLPsM64d7XgQUCZILXtwAKCRDLPsM64d7X gSRLAP4t0JuU0zUGC7oxxu+/WZ9SvkcQhNycQwEsESGo+HiorQD+OwlMD0iR097r NFmHyRq/edaUbR3DR03goEBp5v8KEw4=
    =kWOS
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Luca Boccassi@1:229/2 to Raphael Hertzog on Fri Jun 9 12:40:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Fri, 9 Jun 2023 at 10:53, Raphael Hertzog <[email protected]> wrote:

    On Fri, 09 Jun 2023, Marco d'Itri wrote:
    On Jun 08, Raphael Hertzog <[email protected]> wrote:

    In the same spirit, I'd like to throw an idea... could we decide that base-files is the first package to be configured as part of the bootstrap protocol and change base-files maintainer's scripts into statically linked
    executables so that they can work even if we don't have the library loader
    on the ABI-compliant path?
    It could be even easier: base-files could be unpacked once without
    running the maintainer scripts and then "reinstalled" again later as
    usual.

    I think you are missing the point here, that only works if the package is shipping the symlinks. And the idea is to not do this immediately because
    it breaks debootstrap: if I understood correctly unpacking base-files
    with the symlinks would fail if debootstrap had already pre-created those symlinks (due to a -k option that we should get rid of in /usr/share/debootstrap/scripts/debian-common).

    Hence the special maintainer script to create the required symlinks
    without relying on /bin/sh or any dynamically linked executable.

    Yes I think this will necessarily require another round of debootstrap
    changes once we've locked in on what we want to do, and go via the
    various -p-u queues. I'm pretty sure some buildds will still be stuck
    on Buster for example. I've done this last year and I'm happy to do it
    again once we have a plan.

    Kind regards,
    Luca Boccassi

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Raphael Hertzog@1:229/2 to Marco d'Itri on Fri Jun 9 12:00:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    On Fri, 09 Jun 2023, Marco d'Itri wrote:
    On Jun 08, Raphael Hertzog <[email protected]> wrote:

    In the same spirit, I'd like to throw an idea... could we decide that base-files is the first package to be configured as part of the bootstrap protocol and change base-files maintainer's scripts into statically linked executables so that they can work even if we don't have the library loader on the ABI-compliant path?
    It could be even easier: base-files could be unpacked once without
    running the maintainer scripts and then "reinstalled" again later as
    usual.

    I think you are missing the point here, that only works if the package is shipping the symlinks. And the idea is to not do this immediately because
    it breaks debootstrap: if I understood correctly unpacking base-files
    with the symlinks would fail if debootstrap had already pre-created those symlinks (due to a -k option that we should get rid of in /usr/share/debootstrap/scripts/debian-common).

    Hence the special maintainer script to create the required symlinks
    without relying on /bin/sh or any dynamically linked executable.

    And creating the required symlinks would be done by those (standalone) maintainer scripts...

    I don't know if we already have some rule/invariant in the configuration order of the unpacked packages, but I doubt so.

    Indeed, this would be very simple and it has already been proposed.
    But somebody then complained that special-casing a package would violate
    the design contraints he self-imposed to his own image building tool,
    and as we all know every Debian maintainer can veto any systemic changes that they do not like.

    That's not very helpful. Nobody has vetoed anything here. But I agree that
    it would be cleaner if we could reach a situation where we can just unpack
    all packages and have a working system where we can just "dpkg --configure
    -a" and be done.

    You don't care about this goal, it's fine, but it's not a reason to paint
    this as a black/white picture. We can have both, we just need an
    intermediate step.

    I understand some would rather just be done with this transition (so am
    I...), but going the extra mile here doesn't seem unreasonable.

    ---

    Coming back to my initial suggestion, I realize however that while the maintainer script can run, dpkg itself will not run in the chroot so if debootstrap is relying on dpkg to do the initial base-files configuration,
    this will not work.

    So this looks like that we will have to continue to rely on debootstrap
    to create the symlinks and we will have to fix it so that it can properly unpack a base-files containing /bin and /lib as symlinks on top of
    existing symlinks.

    And the actual switch to include /bin and /lib symlinks in base-files can
    be done once we have fixed debootstrap in all relevant releases. And after
    we can stop pre-creating those symlinks in debootstrap for all future
    releases.

    Cheers,
    --
    ⢀⣴⠾⠻⢶⣦⠀ Raphaël Hertzog <[email protected]>
    ⣾⠁⢠⠒⠀⣿⡁
    ⢿⡄⠘⠷⠚⠋ The Debian Handbook: https://debian-handbook.info/get/
    ⠈⠳⣄⠀⠀⠀⠀ Debian Long Term Support: https://deb.li/LTS

    -----BEGIN PGP SIGNATURE-----
    Comment: Si
  • From Helmut Grohne@1:229/2 to Raphael Hertzog on Fri Jun 9 15:30:02 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi Rapha�l,

    On Thu, Jun 08, 2023 at 10:46:24AM +0200, Raphael Hertzog wrote:
    In the same spirit, I'd like to throw an idea... could we decide that base-files is the first package to be configured as part of the bootstrap protocol and change base-files maintainer's scripts into statically linked executables so that they can work even if we don't have the library loader
    on the ABI-compliant path?

    Thanks for putting effort into this questions. You already figured that
    this poses a problem to dpkg calling the maintainer script. Let me add
    two further observations to further understand the solution space here.

    dpkg has a --root flag and can be called externally. This is something mmdebstrap already uses in some modes. That way, we avoid the issue you presented for dpkg itself. Unfortunately, we cannot assume presence of
    dpkg outside the chroot as debootstrap supports running on non-Debian
    systems, so the --root flag doesn't actually help us here.

    The other aspect is that maintainer scripts that are not interpreted
    break chrootless foreign architecture bootstrap as the
    base-files.preinst would be an executable that the processor cannot
    execute.

    In a vague reply to the other messages as well: I repeatedly got the
    feedback that I have not sufficiently exploited the solution space. I
    hear you. My lack of replies here shall indicate that I'm not done.

    I have a vague sketch that seems to kinda work out for everything, but
    maybe it still has some problems that I don't see yet. Let me summarize
    it even though this very much is unfinished. Given my earlier
    categorization of the solution space, this is a category 2 solution
    addressing many of the problems mentioned there.

    Update debootstrap (in bookworm and unstable) to create the symbolic
    links after unpacking rather than before while still doing it before
    running any maintainer scripts. This enables us to ship the symbolic
    links in some data.tar while keeping bootstraps of bookworm and earlier
    working as before.

    Add a new package usrmerge-support (or whatever). It is a bit similar to multiarch-support: It must not have any dependencies or
    pre-dependencies. It will not have files, but maintainer scripts. Those
    scripts set up protective diversions on behalf of base-files for the
    symbolic links that cause aliasing. Then base-files will issue a
    Pre-Depends on usrmerge-support (but not yet ship symlinks). I initially thought, this could be part of usr-is-merged, but then base-files would
    pull that and standard mmdebstrap would no longer pull usrmerge and
    break. So it really needs to be a separate package. Anyway, once we have protective diversions, we can move files without risking that dpkg
    deletes the symbolic links.

    Then we can actually perform that move of files to their canonical
    locations except for a small set of locations including dash, bash,
    libc6, and util-linux (maybe not exhaustive). [There is a lot of missing
    detail about non-bootstrap aspects here.]

    Once all essential packages (but the exceptions) have no files left in
    aliased locations, we can upload base-files adding the symlinks together
    with the packages previously kept unmodified in one dinstall. Before
    that dinstall, things will continue to work normally. The protective
    diversions will not affect unpacking, because dpkg only performs exact
    matches on diversions. After that dinstall, base-files will create the
    symlinks and things will hopefully work (because the patched debootstrap
    only creates them after the initial unpack).

    This still is a lot of wishful thinking. I've prototyped parts of this,
    but not the entire story. I'm pretty sure it'll not work out as written
    here, but maybe some adaption of it will unless insurmountable issues
    pop up. For instance, debootstrap --variant=buildd (which currently
    implies --no-merged-usr) will need a second thought.

    You may now tell me why this is utter nonsense and why it cannot work at
    all. Thanks.

    Helmut

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Johannes Schauer Marin Rodrigues@1:229/2 to All on Fri Jun 9 17:40:03 2023
    XPost: linux.debian.devel
    From: [email protected]

    Quoting Marco d'Itri (2023-06-09 09:41:43)
    On Jun 08, Raphael Hertzog <[email protected]> wrote:
    And creating the required symlinks would be done by those (standalone) maintainer scripts...

    I don't know if we already have some rule/invariant in the configuration order of the unpacked packages, but I doubt so.
    Indeed, this would be very simple and it has already been proposed.
    But somebody then complained that special-casing a package would violate
    the design contraints he self-imposed to his own image building tool,
    and as we all know every Debian maintainer can veto any systemic changes that they do not like.

    I definitely complained about special-casing a package because it would violate the design contract for my own image building tool. You would not by any chance be talking about me in your last message, would you?

    Anyway, great communication style. This will totally help bringing us all together to create a great operating system. Very productive. I already feel a lot more motivated to discuss technical matters with you.

    Now who do I have to talk to in case I'd really like to veto something?

    Thanks!

    cheers, josch
    --==============#68899939597870822=MIME-Version: 1.0
    Content-Transfer-Encoding: 7bit
    Content-Description: signature
    Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmSDRXoACgkQ8sulx4+9 g+HPaA/+Oj2fGprWSQfJWDiTtk8A637/0OEB5KcRDEX49rUuty8DNCMRIhweAKn4 hkoWLVTQP+/rmrXvJaRohp72Q7YfVwNH4AMLGv5Hl14c1wOgfbYmdlrnW4VQ8je+ 32mob8xnkKJlHGaVQJ1b5Sn4ClNZgn2myPvH1TR/EggbNmZtnPgdkeWA6pRsvl1Y OUVYEmilUkrfR0bK34A8WFxxau5FJuqRGV2jUd3vZyCHepZHrDpuHJvGr6Q4sxba DYQXzmM8pHgrH4E2O1i8aTyTdmTzBQIFt+51nEzV4EKpIvbui1oWwAwkShRiyLug ErgpibcAhoasa6a6KCf7pgwZJa3cM1OuzJl/upqb4EitGsO9VsSvf5MG5DgSzLdL 92n933zmmyWnGN9MhdS6CfJnZJIEmzKK38UapfLoOGTp2F8SaG0BIdUXYnPSgTBA pLrpFNw1mgoH0KPc8D60aYnfvVC6nWCIoXrrlG0cQ+hJHQdnPEMEIxbiwCwK6Myr hiPIaxccjITaSXVap3YKHLnouFR6oYLxizYjtL4WwAsP51mZ7BQbrxfGtIF3duu5 6x6H1euXQC5eNM8gC4Ri/9fnDFyr4QSlgzf8JhS4hV1hZzYkGQS1UTRsyTz7fwnb 1wnGV9yRKpoT8Na58xn/CL7ZouQvzlBWVipwE9HifyeNblnmz6c=
    =bZht
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Johannes Schauer Marin Rodrigues@1:229/2 to All on Fri Jun 9 17:50:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi,

    Quoting Helmut Grohne (2023-06-09 15:22:39)
    Add a new package usrmerge-support (or whatever). It is a bit similar to multiarch-support: It must not have any dependencies or pre-dependencies. It will not have files, but maintainer scripts. Those scripts set up protective diversions on behalf of base-files for the symbolic links that cause aliasing. Then base-files will issue a Pre-Depends on usrmerge-support (but not yet ship symlinks). I initially thought, this could be part of usr-is-merged, but then base-files would pull that and standard mmdebstrap would no longer pull usrmerge and break. So it really needs to be a separate package. Anyway, once we have protective diversions, we can move files without risking that dpkg deletes the symbolic links.

    Then we can actually perform that move of files to their canonical
    locations except for a small set of locations including dash, bash,
    libc6, and util-linux (maybe not exhaustive). [There is a lot of missing detail about non-bootstrap aspects here.]

    Once all essential packages (but the exceptions) have no files left in aliased locations, we can upload base-files adding the symlinks together
    with the packages previously kept unmodified in one dinstall. Before
    that dinstall, things will continue to work normally. The protective diversions will not affect unpacking, because dpkg only performs exact matches on diversions. After that dinstall, base-files will create the symlinks and things will hopefully work (because the patched debootstrap only creates them after the initial unpack).

    if I understand that plan correctly, the usrmerge-support package setting up diversions is only necessary because you want to avoid having to do the move to /usr of *all* affected packages in the essential set in a single dinstall? Is that correct?

    If yes, how many source packages are we have to be modified part from base-files, dash, bash, libc6, and util-linux?

    Is it just these? audit bzip2 coreutils debianutils dpkg gcc-13 grep gzip hostname libcap2 libcap-ng libgpg-error libselinux libxcrypt ncurses pam sed shadow sysvinit tar xz-utils zlib

    Would it be too much to prepare patches for all of these, test that everything works with some QA setup and then NMU all 22 source packages with pre-approved patches in a single dinstall? Would that avoid having to temporarily go via a usrmerge-support package?

    Thanks!

    cheers, josch
    --==============C86795693428818027=MIME-Version: 1.0
    Content-Transfer-Encoding: 7bit
    Content-Description: signature
    Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmSDSakACgkQ8sulx4+9 g+Gv1hAAom/ZhgKy/O45qaK9c8L1BceGiIBVv4Eh1KpixkMdVcuiWSR6uvQ1vnkS fzH3/7G3EQLpoOfTpaZPqiAKOzWM+v02/ziPUUwHGNZvIMsyZVluFWuVBNX6AM+x 1kAGw5Yd2c6Ipj+FUaLkB8/6BOS5CaWiu4JJdgt5gkBxHTmskA+4q85QHsa/btM8 rjgORQxHIGf/G2Zbp6iNl5WfW6gwq0G3SN5vABDYOTPH3mLb7DsCyDyJ+dpNON9y DjLihpcYybny0JKws2EEg9EsPoodyVn2n+F4DYbI8ULp5D1DTmgUOdDd9FxIWyP8 mbi2sUILWfTged8ukN154m+szCbGZCGLBH1Ma/c6F828LVyGCafeLD3K5NvQMrbI 3cux0BewVf5Uet+IPOW27RZzJGFAM2EXam+6jFfSD/4hA7IRjAxablU7SMpEz965 tiIsOpYlfSGlRTqQEBc7iiGhWwgTm1zQ1jwQhXuamclgK4b52NQgKhW+v/mNaSOJ FMbkUMMk4l9sbz3aLFKn5sCvfjoNYxcYQPLwViRRsz4RqW44hlQEeIUXIIxyxoDk 7EXF+HngVnZ+mfMkd9U/3OlkSxUn16BJc92US0S24z2YOhztJjXJ9sDEEGmP32fi /urPKHQrnT+1UFfD4M5UPRGT4nUt+oz9UselZ0uzDiSXFZ9nFWU=
    =rtoj
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Helmut Grohne@1:229/2 to Johannes Schauer Marin Rodrigues on Fri Jun 9 18:30:01 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi Johannes,

    On Fri, Jun 09, 2023 at 05:47:56PM +0200, Johannes Schauer Marin Rodrigues wrote:
    if I understand that plan correctly, the usrmerge-support package setting up diversions is only necessary because you want to avoid having to do the move to
    /usr of *all* affected packages in the essential set in a single dinstall? Is that correct?

    This is not correct. In bookworm -> trixie upgrade scenario, we intend
    to move all the files from / to /usr. Now we look into how this happens
    focus on one particular symlink, without loss of generality choose /bin.
    Since /bin is no longer in the dpkg database at the end of the upgrade,
    some package must be the last one to contain /bin. When upgrading (or
    removing that package), dpkg will attempt to remove /bin (which in its
    opinion is an empty directory and the last consumer is releasing it).
    However, since dpkg has no clue about file types, it doesn't actually
    know that this is a directory and takes care of the /bin -> /usr/bin
    symlink using unlink(). And this is where /bin vanishes. Oops.

    So the idea here is to add a protective diversion for /bin such that
    removing /bin instead removes some path we don't care about. The
    important thing now is that every package that moves stuff from /bin to /usr/bin needs to ensure that this diversion exists. We can achieve that
    in one of two ways. Either that some package (and with that I mean every package that ships stuff in /bin, because we cannot predict which
    package will be last) gains a preinst that sets up this diversion (on
    behalf of base-files) or it Pre-Depends on some package that handles
    setting up this diversion. It seems rather obvious that we might just
    have a versioned "Pre-Depends: base-files (>= version that introduces
    the diversion)", but then we get a pre-dependency loop from base-files
    via an awk implementation to libc6 and then (via this new Pre-Depends)
    back to base-files. So base-files cannot be the package that we list in Pre-Depends here. And this is where usrmerge-support comes into the
    picture. Any package that moves stuff out of one of the aliased
    directories gains a Pre-Depends: usrmerge-support to protect the
    aliasing symlinks from deletion.

    Please note that this hasn't been obvious to me at all. I totally didn't
    see this pre-dependency loop coming until dpkg told me when I actually
    tried this.

    So this usrmerge-support package very much is not for reducing that set
    that we have to upload in one dinstall, but for making smooth upgrades
    work at all.

    This really is an important detail and I'm sorry for having missed it in
    my previous mail. Thanks for asking.

    If yes, how many source packages are we have to be modified part from base-files, dash, bash, libc6, and util-linux?

    Given the above, I think this no longer is relevant.

    Would it be too much to prepare patches for all of these, test that everything
    works with some QA setup and then NMU all 22 source packages with pre-approved
    patches in a single dinstall? Would that avoid having to temporarily go via a usrmerge-support package?

    I have considered this approach and if it gains us something I
    definitely see it as something to consider, but given the above, it
    doesn't save us from usrmerge-support.

    The other thing that we need usrmerge-support for is the dpkg-divert
    wrapper. Any package that contains an aliased diversion or moves a
    diverted file from an aliased location will likewise have to gain a pre-dependency on usrmerge-support. Again, we cannot do this in
    usr-is-merged, because that would kick usrmerge out of the default
    essential set and thus break mmdebstrap.

    Helmut

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From HW42@1:229/2 to All on Fri Jun 9 22:30:01 2023
    XPost: linux.debian.devel
    From: [email protected]
    To: [email protected]

    This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------c8H0cp949IxHmksbsCCdvopz
    Content-Type: text/plain; charset=UTF-8
    Content-Transfer-Encoding: quoted-printable

    Helmut Grohne:
    Hi Johannes,

    On Fri, Jun 09, 2023 at 05:47:56PM +0200, Johannes Schauer Marin Rodrigues wrote:
    if I understand that plan correctly, the usrmerge-support package
    setting up diversions is only necessary because you want to avoid
    having to do the move to /usr of *all* affected packages in the
    essential set in a single dinstall? Is that correct?

    This is not correct. In bookworm -> trixie upgrade scenario, we intend
    to move all the files from / to /usr. Now we look into how this
    happens focus on one particular symlink, without loss of generality
    choose /bin. Since /bin is no longer in the dpkg database at the end
    of the upgrade, some package must be the last one to contain /bin.
    When upgrading (or removing that package), dpkg will attempt to remove
    /bin (which in its opinion is an empty directory and the last consumer
    is releasing it). However, since dpkg has no clue about file types, it doesn't actually know that this is a directory and takes care of the
    /bin -> /usr/bin symlink using unlink(). And this is where /bin
    vanishes. Oops.

    So the idea here is to add a protective diversion for /bin such that
    removing /bin instead removes some path we don't care about. [...]

    Did you consider just having one package keep one dummy file in /bin?
    While this isn't elegant it sounds much less complex than diversions and
    tricky pre-depend loops, etc.

    I might be very well missing something here (for example maybe it's
    really essential that no files remain in /bin, even not a dummy file).
    But in the other branch of this thread you welcomed "dumb" questions, so
    here you go ;]

    --------------c8H0cp949IxHmksbsCCdvopz--

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEqieyzvOmi9FGaQcT5KzJJ4pkaBYFAmSDhCMACgkQ5KzJJ4pk aBZtxQ/8C8ofab3tnfWrTkHGexjzvEVMOQMvAlOhqcRb2yLLoHG0RQ53C+RVzcTX L1KfoBM6WLNyiMB0gXiZNIX7eRJIDfGChKhCv5YcsTYEX4OIbuSBQsOj30R9VIQ8 IcLlIuwOEomh+VrYmiDt7cstI/DavG43H2zI0maLrp05AnJ0tRieyZFPWkl81GfO 5A8eV6wlJQ8zULlZQ73SBYkFDhLBH5Mfp5tMKTjP63r6STOoieR+BBeOMOv+CEZ4 MNLhYJUFf/P3S14YqJe8mwK6JUX5vP8Frb2ejgogxbzA71iMM0YJZJisiCrSorTp nbra/On6B/+/zuwBuU7PJghuG97ovUojfaXET2Mu94awYjHau/Dppd7Usb+9+Y1w CTfrMzOAJkcBgIL09FTuv8rHI15l/ocWWdW1egbsH9ZEjX1BMmou37/JxS5lVttJ nqAJUypTHScEcG86/rbe84N4n2y133G+kIh/QbU/vIvCRfV34KXp9Rk3JtPNpfsn zwvp/ev5d2fkzIFSZQtuWb4MF80rFKa4TFXKCBCl1dXHb+WkYSAQUgt0QHGPmoq1 rZFG/xebvrocSkQlHiGn0cFQf1m7cBbVGUZxJM9iT4GoeuhymMnV2tj/0NAldsRy Gf/YWmWvHfr8zBrkl1STcDTzaN8tw0fYxCMJWgbSfxDr02X6U+4=
    =UWzs
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Helmut Grohne@1:229/2 to All on Sat Jun 10 07:40:02 2023
    XPost: linux.debian.devel
    From: [email protected]

    Hi,

    On Fri, Jun 09, 2023 at 09:57:21PM +0200, HW42 wrote:
    Did you consider just having one package keep one dummy file in /bin?
    While this isn't elegant it sounds much less complex than diversions and tricky pre-depend loops, etc.

    The dummy file is not necessary. Debian packages can ship empty
    directories. Having any package ship /bin (empty or not) is fully
    sufficient to prevent dpkg from removing it.

    I might be very well missing something here (for example maybe it's
    really essential that no files remain in /bin, even not a dummy file).
    But in the other branch of this thread you welcomed "dumb" questions, so
    here you go ;]

    Yeah, I consider the property that nothing ships anything in aliased
    locations an important one. So let us go down for the consequences of
    not doing that.

    So some package will keep shipping /bin. It does't really matter which,
    but clearly this package must be part of the essential set (otherwise
    you could remove it and with it /bin would be deleted). This is cool for upgrades, but less so for bootstrapping tools.

    One of the approaches to making bootstrapping work was adding the
    symlinks to some data.tar. That has been category 2 from my earlier
    mail. We definitely cannot add /bin as a directory to one package and
    /bin as a symlink to another (unless using diversions), because the
    resulting behaviour is dependent on the unpack order when used with
    dpkg. Also any bootstrap tool that unpacks with tar -k (such as
    debootstrap) requires changes to support this. So this pretty much
    precludes completing the transition in a way that just unpacking all
    data.tar of essential packages gives you a working chroot. In effect,
    this requires a proposal to change the bootstrap protocol (category 4)
    in order to make sense.

    There is a loop hole that I ignored here. While /bin cannot be both a
    directory and a symlink at the same time, we can upgrade it. So if we
    somehow managed to get one and only one package to contain /bin as a
    directory, we could upgrade that to a symlink. Unfortunately, any
    external package that still ships stuff in /bin breaks this. In effect,
    any addon repository or old package can break your system.

    The other way of seeing us keep /bin as a directory is to not
    canonicalize (i.e. category 1). Then we'd simply keep (wlog) /bin/sh in
    /bin and not move it to /usr.

    Can you elaborate in what way you see protective diversions as adding complexity? It can be as simple as:

    dpkg-divert --add /bin --divert someplacewedontcare --package base-files --no-rename

    We'd add this to one package and everyone else can issue Pre-Depends.

    The benefit we gain from keeping /bin is not clear to me (beyond
    avoiding a diversion). At this time, it seems to me that doing that
    either requires changing all bootstrapping tools (in yet unspecified
    ways) or never canonicalizing all paths (according to the dpkg
    database).

    Now I'm wondering what I am missing here.

    Helmut

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Askar Safin@1:229/2 to All on Sun Jan 21 18:20:01 2024
    XPost: linux.debian.devel
    From: [email protected]

    Hi, Helmut. I'm very sorry for responding to an 8-months old letter,
    but I think my message is important.

    Helmut Grohne:
    * mmdebstrap operates in two phases. It first unpacks and configures a
    rather minimal set of packages and then proceeds to adding packages
    passed to --include in a second phase once essential is fully
    configured while debootstrap immediately unpacks everything.

    I think the debootstrap approach is slightly worse here, because it
    means that preinst scripts of non-essential packages cannot rely on
    essential packages having been configured.

    This is not true. Here is output of debootstrap: https://paste.debian.net/1304816/ .

    We created current sid from sid. As you can see, mc unpacked in very last stage.

    The same can be seen in debootstrap.log: https://paste.debian.net/1304817/

    Moreover, I did another experiment: I did run debootstrap and aborted
    it immediately after output "Unpacking the base system..."
    The resulting system did not contain "mc" binary at all!

    (This is answer to https://lists.debian.org/debian-dpkg/2023/05/msg00080.html ) --
    Askar Safin

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)