commit f3d1acfbd1e73e25b5c6dd5ac6e2e9c7c9ddfd35
from: Isaac Meerleo <isaac@itm.works>
date: Thu Jul 16 19:55:48 2026 UTC

stage local port without doas

Keep local port metadata and distfile preparation under the ordinary ports user. Reserve privilege for the subsequent package install or reinstall and regress against accidental doas use.

commit - d938d900f498a61d393c96bc79c0477cc5477209
commit + f3d1acfbd1e73e25b5c6dd5ac6e2e9c7c9ddfd35
blob - a51b8fb17ec60e7d0331f4e5096656af7857cc4a
blob + c6f964010afd0dda8561527770472213679fd99b
--- docs/openbsd-development.md
+++ docs/openbsd-development.md
@@ -129,6 +129,8 @@ computed package path, package name, distfile name, an
 then archives the exact `HEAD` commit with the computed `DISTNAME` prefix,
 installs that archive in the computed distfile directory, and runs both
 `makesum` and `checksum`. The old staged port is restored if validation fails.
+The target runs entirely as the ordinary ports user and never invokes `doas`;
+that user must be able to write the `mystuff` and computed distfile directories.
 
 `git archive` deliberately excludes `.git`, build objects, untracked files,
 and uncommitted changes. The generated `distinfo` belongs only to the
blob - e4fa9c1c953f75b146c202c66daef665238b5ee5
blob + a2551a99413cd3d754656a085ddc4f9fb6fb6877
--- regress/local_port/run.sh
+++ regress/local_port/run.sh
@@ -106,7 +106,7 @@ cat >"$bindir/doas" <<'EOF'
 #!/bin/sh
 set -eu
 printf '%s\n' "$*" >>"$FUGU_TEST_DOAS_LOG"
-exec "$@"
+exit 99
 EOF
 chmod 0755 "$repo/scripts/local-port" "$bindir/port-make" "$bindir/doas"
 
@@ -119,13 +119,14 @@ commit=$(git -C "$repo" rev-parse HEAD)
 
 export FUGU_LOCAL_PORTDIR="$portdir"
 export FUGU_LOCAL_PORT_MAKE="$bindir/port-make"
-export FUGU_LOCAL_PORT_DOAS="$bindir/doas"
 export FUGU_TEST_PORTDIR="$portdir"
 export FUGU_TEST_PORTSDIR="$portsdir"
 export FUGU_TEST_DISTDIR="$distdir"
 export FUGU_TEST_FULLPKGPATH=productivity/fugu
 export FUGU_TEST_MAKE_LOG="$dir/make.log"
 export FUGU_TEST_DOAS_LOG="$dir/doas.log"
+PATH=$bindir:$PATH
+export PATH
 
 make -s -C "$repo" local-port >"$dir/first.out" 2>"$dir/first.err"
 rc=$?
@@ -152,9 +153,8 @@ grep -q 'show=FULLPKGPATH' "$dir/make.log" &&
     grep -q '^.*checksum$' "$dir/make.log"
 ok "framework: computed package path, makesum, and checksum are used" $?
 
-grep -Fq "install -m 0644" "$dir/doas.log" &&
-    grep -Fq "$distdir/fugu-0.3.tar.gz" "$dir/doas.log"
-ok "privilege: only staging operations cross the doas adapter" $?
+test ! -e "$dir/doas.log"
+ok "privilege: port and distfile staging never invoke doas" $?
 
 printf 'uncommitted\n' >"$repo/dirty.txt"
 if make -s -C "$repo" local-port >"$dir/dirty.out" \
blob - 84bbe48767d5de1590a9b2ef217f1f31a0979b74
blob + 5e89f159ae1555784ddb6d408d2165b101b601e1
--- scripts/local-port
+++ scripts/local-port
@@ -25,7 +25,6 @@ root=$(cd "$(dirname "$0")/.." && pwd)
 port_source=$root/port/productivity/fugu
 port_dir=${FUGU_LOCAL_PORTDIR:-/usr/ports/mystuff/productivity/fugu}
 port_make=${FUGU_LOCAL_PORT_MAKE:-make}
-doas=${FUGU_LOCAL_PORT_DOAS:-doas}
 expected_pkgpath=productivity/fugu
 
 tmp=
@@ -75,11 +74,6 @@ cleanup()
 trap cleanup EXIT
 trap 'exit 1' HUP INT TERM
 
-run_privileged()
-{
-	"$doas" "$@"
-}
-
 port_value()
 {
 	name=$1
@@ -98,7 +92,6 @@ port_value()
 command -v git >/dev/null 2>&1 || die "git is not installed"
 command -v "$port_make" >/dev/null 2>&1 ||
     die "$port_make is not executable"
-command -v "$doas" >/dev/null 2>&1 || die "$doas is not executable"
 [ -d "$port_source" ] || die "$port_source is missing"
 
 case "$port_dir" in
@@ -115,10 +108,8 @@ fi
 commit=$(git -C "$root" rev-parse --verify HEAD) ||
     die "cannot resolve the current commit"
 
-owner=$(id -un)
-group=$(id -gn)
 port_parent=${port_dir%/fugu}
-run_privileged install -d -o "$owner" -g "$group" "$port_parent" ||
+install -d "$port_parent" ||
     die "cannot prepare $port_parent"
 
 stage=${port_dir}.new.$$
@@ -171,10 +162,10 @@ git -C "$root" archive --format=tar.gz --prefix="${dis
 digest=$(sha256 -q "$archive_tmp") || die "cannot checksum $archive_tmp"
 
 if [ ! -d "$fulldistdir" ]; then
-	run_privileged install -d -m 0755 "$fulldistdir" ||
+	install -d -m 0755 "$fulldistdir" ||
 	    die "cannot create $fulldistdir"
 fi
-run_privileged install -m 0644 "$archive_tmp" "$fulldistdir/$archive" ||
+install -m 0644 "$archive_tmp" "$fulldistdir/$archive" ||
     die "cannot install $archive in $fulldistdir"
 
 "$port_make" -C "$port_dir" makesum || die "make makesum failed"