Building fails when a dependency tarball has files with uid 0

[utdemir]

When building a package depends on char-regex-1.0.2, building that depedency fails at unpackPhase:

builder for '/nix/store/h87kk5zssq2kdajfmzswbzf437n83j1k-char-regex-1.0.2.drv' failed with exit code 1; last 8 log lines:
  unpacking sources
  unpacking source archive /nix/store/v9p98kqplf4kflmy91p0687xlvr6klb1-char-regex-1.0.2.tgz
  source root is package
  chmod: cannot access 'package/package.json': Permission denied
  chmod: cannot access 'package/index.d.ts': Permission denied
  chmod: cannot access 'package/index.js': Permission denied
  chmod: cannot access 'package/README.md': Permission denied
  chmod: cannot access 'package/LICENSE': Permission denied

Here're the contents of the mentioned tarball:

% tar -tvf /nix/store/v9p98kqplf4kflmy91p0687xlvr6klb1-char-regex-1.0.2.tgz
drw-rw-rw- 0/0               0 2020-02-18 22:50 package
-rw-rw-rw- 0/0             297 2020-02-18 22:50 package/index.d.ts
-rw-rw-rw- 0/0            1920 2020-02-18 22:50 package/index.js
-rw-rw-rw- 0/0            1092 2020-01-31 23:31 package/LICENSE
-rw-rw-rw- 0/0             937 2020-02-18 22:51 package/package.json
-rw-rw-rw- 0/0             713 2020-02-18 22:50 package/README.md

I think the files having uid/gid 0/0 causes a permission error.

I was able to mitigate the issue with overriding unpackPhase and passing --no-same-owner flag to tar:

diff --git a/nix-lib/buildNodePackage.nix b/nix-lib/buildNodePackage.nix
index e32c6bd..e490207 100644
--- a/nix-lib/buildNodePackage.nix
+++ b/nix-lib/buildNodePackage.nix
@@ -30,6 +30,19 @@ in stdenv.mkDerivation ((removeAttrs args [ "key" "nodeBuildInputs" ]) // {
   # skip the build phase except when given as attribute
   dontBuild = !(args ? buildPhase);
 
+  # unpacking fails when the tarball contains files with uid 0
+  unpackPhase = ''
+    case "$src" in
+      *.tgz)
+        tar xf "$src" --strip 1 --no-same-owner
+        ;;
+      *)
+        cp -rT "$src" ./
+        ;;
+     esac
+  '';
+
   # TODO: maybe we can enable tests?
   doCheck = false;

My patch isn't great, since it assumes that the src is either a tgz file or a directory. Which seems to work because this function is only called with npm tarballs for dependencies, and once more for the actual project, which is a directory.

As another possible solution; looking at the default unpackPhase, these lines seem relevant: https://github.com/NixOS/nixpkgs/blob/d79612672e0ac39072754dce5a812c64a01c9cb2/pkgs/stdenv/generic/setup.sh#L914-L919. However, simply passing something like dontMakeSourcesWritable = 1 didn't help in my case.

[sternenseemann]

Seems to me that the issue is not necessarily that the files in the tar archive are owned by root, but that they are owned by root and the directory is not marked as executable: dontMakeSourcesWritable = true works, but leads to the following:

find: 'package/index.d.ts': Permission denied
find: 'package/index.js': Permission denied
find: 'package/LICENSE': Permission denied
find: 'package/package.json': Permission denied
find: 'package/README.md': Permission denied
/nix/store/333six1faw9bhccsx9qw5718k6b1wiq2-stdenv-linux/setup: line 1304: cd: package: Permission denied

The fix seems to be to set

   postUnpack = "chmod +x $sourceRoot";
   dontMakeSourcesWritable = true;

in _buildNodePackage. But I'm not sure if this isn't asking for another edge case.

The best courses of action I can think of:

• Make it easy to override _buildNodePackage in `buildNodeDeps, so you can easily fix this locally if necessary
• Add a fix for this in nixpkgs
• Get char-regex to release an 1.03 with a non-broken tar ball (we definitely should do this)

[ziprandom]

meanwhile can you provide a snippet to patch this from outside using .override or smth. ?

[Profpatsch]

@ziprandom are you having the same problem?

[ziprandom]

@Profpatsch yes

[sternenseemann]

Ugly hack which you can try to fix your problem (also interesting question if this causes any other problems).
I'd like to get rid of the postUnpack, I believe we can upstream a fix for that in nixpkgs maybe?
It is only necessary for char-regex which just has a terribly broken tar ball.

diff --git a/src/Distribution/Nixpkgs/Nodejs/OptimizedNixOutput.hs b/src/Distribution/Nixpkgs/Nodejs/OptimizedNixOutput.hs
index f24ceb0..24f395e 100644
--- a/src/Distribution/Nixpkgs/Nodejs/OptimizedNixOutput.hs
+++ b/src/Distribution/Nixpkgs/Nodejs/OptimizedNixOutput.hs
@@ -270,6 +270,8 @@ mkPackageSet packages =
         $ ("super" !!. "_buildNodePackage") @@ N.mkNonRecSet
           [ inheritStatic ["key", "version"]
           , "src" $= srcNExpr
+          , "dontMakeSourcesWritable" $= N.mkBool True
+          , "postUnpack" $= N.mkStr "chmod +x \"$sourceRoot\""
           , "nodeBuildInputs" $= "deps" ]
     -- | Building a 'YLT.FileRemote' package.
     buildPkgFn :: NExpr

[ziprandom]

@sternenseemann I'm just trying to get a build to work, so I was wondering whether nixs builtin overloading facilities can help me instead of patching source code ..

[sternenseemann]

@ziprandom Unfortunately the nix library of yarn2nix is not overrideable yet since it has no fix point…

The easiest way to do it is probably to add the following to nix-lib/buildNodePackage.nix:

  dontMakeSourcesWritable = false;
  postUnpack = ''
    chmod +x $sourceRoot"
  '';

Also not really nice, sorry :/

[ziprandom]

@sternenseemann no problem & thanks for the effort! I will try that ..

[sternenseemann]

Should be resolved upstream in nixpkgs when #117357 lands.