Source: apt-listbugs
Version: 0.1.41
Severity: normal

Dear Maintainer,

your package installs the filename apt-listbugs to both bin and sbin as opposed to just one of those locations.

This causes a problem on a filesystem layout where bin and sbin are merged into a single real directory, typically by sbin being a symlink to bin. Such a filesystem layout has become standard on some distributions now, and others are moving onto in their
next releases.

Please pick one location and install it only there. /usr/bin is preferred over any other location.

Thank you for maintaining software in debian.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Control: tags -1 + moreinfo


On Sun, 25 Feb 2024 21:36:44 +0000 cacin@allfreemail.net wrote:

[...]

Dear Maintainer,

your package installs the filename apt-listbugs to both bin and sbin as opposed to just one of those locations.

Hello,
thanks for your bug report.

The command 'apt-listbugs' is installed to /usr/bin and a symbolic link
to it is installed to /usr/sbin .

A long time ago, the package used to only install the command
to /usr/sbin , but apt-listbugs may be useful for unprivileged users
too (for some of its functionalities), hence it was moved to /usr/bin ,
with a symlink from /usr/sbin for backward compatibility (to avoid
breaking possible custom scripts with the full path hardcoded...).

This causes a problem on a filesystem layout where bin and sbin are merged into a single real directory, typically by sbin being a symlink to bin.

This layout is not currently supported by Debian, as far as I can tell.

Such a filesystem layout has become standard on some distributions now, and others are moving onto in their next releases.

Which distributions?

I am not aware of any plans in Debian to move in that direction.

See the [usrmerge FAQ], which includes, in part:

[...]
| Is this about merging /usr/bin/ and /usr/sbin/?
|
| No, there are no plans to do that.
[...]

[usrmerge FAQ]: <https://wiki.debian.org/UsrMerge>


Could you please elaborate a bit more on why you think this feature of
the apt-listbugs Debian package could be an issue?

Which other distributions (Debian-derivatives or otherwise) include apt-listbugs?
Without massive modifications, apt-listbugs can only be useful for
APT-based distributions with a debbugs-based bug tracking system.
As far as I know, there are no other such distributions beyond Debian.
Do you happen to know any?

Please pick one location and install it only there. /usr/bin is preferred over any other location.

I am a bit hesitant to do so (risking to break random custom scripts),
unless there's a good reason.

If you explain which distributions are or could be affected by this
feature of apt-listbugs, I will think about it.
Otherwise, I can close this bug report, since what you are reporting
does not seem to be an actual issue for Debian.

Thank you for maintaining software in debian.

You're welcome.
Thanks to you for caring about apt-listbugs!



--
http://www.inventati.org/frx/
There's not a second to spare! To the laboratory! ..................................................... Francesco Poli .
GnuPG key fpr == CA01 1147 9CD2 EFDF FB82 3925 3E1C 27E1 1F69 BFFE

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEygERR5zS79/7gjklPhwn4R9pv/4FAmXbyPgACgkQPhwn4R9p v/7YYRAAxZIYMTbJlnbzkzN92D9T6TjvYV2fPGaaNGxG/dNa08Gs7aJw40NMuZH+ 7YtTqVR3m2DZKs1ftFprTfL2D5LXOVDWYMvPrsqgNGYg/IX9cgKqsgY+lFU3IHcO MegsGQQhEMXN0ikC/kNa8S0BzNnTE66Y+BmIRk2Puf4g0yrW6YHz/VjTi3pht2kT L9xZo1kd0i9fi/i1H0c6nnt4Jxv2c8g8bX1jZcZIA0RkGyhkI2TDh6rCQt9p/Afc Jzg20fhGEsoorRzGJ200ryub0YOH0Ut1ib2yrsTSoE4V2bo3IxUTcHDQRhF2v7Bf HHr9ULBhkheY9dUVArsSHMQvFMMrFbwCKi9F0Fg7BJb7FUQlSwMAKjeCRjrgl3+C Xwuri5BZ+fOvvZayR/jNM6BtDH4JISqJJNBmLZD2Hgb6co4gg7GMwDtSMMaeVOQC Iz45PToSMe3Bbfg3Z/vKigg7LaGy617xy7Hym6iW5pPWzs9cXauLpmvNFq0Pp0ZF Kj/mBkOwdLA/yFd5MUlrW0XqSSTmJS0L7dk+0ho8GuYJpwCaNtyRWYpZ39KfRQlM wqICWaaoolsapFHMhvEIOma1aHldlBjuRtBGF3DE+ubPnShn2Au8dacPQlGkY6vm btrpiFYXNJTlYELE+iqLdZqhclWjdj7u

Source: apt-listbugs
Followup-For: Bug #1064783

The command 'apt-listbugs' is installed to /usr/bin and a symbolic link
to it is installed to /usr/sbin .

You are correct, and on a filesystem where those locations are the same
it causes unpacking errors.

This layout is not currently supported by Debian, as far as I can tell.

It is not yet supported on debian, but using debootstrap instead of debian-installer makes it possible to create such a filesystem layout.
This is currently useful for testing how adding /usr/sbin to default
user $PATH would break, and how merging /usr/sbin and /usr/bin would
break.

Which distributions?

Archlinux has had merged bin and sbin for a number of years. Fedora is
going in that direction soon and made a nice writeup on https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin

I am not aware of any plans in Debian to move in that direction.

So far it has been briefly discussed in the -devel channel on IRC and
the idea has been received mostly well. There are bigger problems with
it, such as different packages having undeclared file conflicts if the sbinmerge happenen, however it is a nice low-hanging fruit to first fix
the few packages where the one package unpacks the same file (or
symlink) to both bin and sbin.

See the [usrmerge FAQ], which includes, in part:

You are correct, this is not about the current usrmerge. It could be called usrmerge2.0 or sbinmerge or some other term.

Could you please elaborate a bit more on why you think this feature of
the apt-listbugs Debian package could be an issue?

On a filesystem where bin and sbin are merged, it causes an unpacking
error during installation of the package, due to the symlink trying to overwrite the real file, or the real file overwriting the symlink. It is
in a way a file conflict - it can be silenced by passing the right flags
to the commands, but it is better to fix it properly.

Which other distributions (Debian-derivatives or otherwise) include apt-listbugs?

I don't know of any.

I am a bit hesitant to do so (risking to break random custom scripts),
unless there's a good reason.

The idea of merging bin and sbin is exactly to help with random custom
scripts, because if bin and sbin are the same directory, then it doesn't
matter if only bin or only sbin is in $PATH, or if the executable is
called directly using hardcoded /usr/bin/apt-listbugs or /usr/sbin/listbugs, because both ways will then work instead of giving "command not found"
errors.

However I agree that in the meantime some random script somewhere could
break, and so such a change might warrant a NEWS entry.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Control: tags -1 - moreinfo
Control: severity -1 wishlist


On Mon, 26 Feb 2024 11:08:29 +0000 cacin@allfreemail.net wrote:

Source: apt-listbugs
Followup-For: Bug #1064783

The command 'apt-listbugs' is installed to /usr/bin and a symbolic link
to it is installed to /usr/sbin .

You are correct, and on a filesystem where those locations are the same
it causes unpacking errors.

Yes, that's clear.

This layout is not currently supported by Debian, as far as I can tell.

It is not yet supported on debian, but using debootstrap instead of debian-installer makes it possible to create such a filesystem layout.
This is currently useful for testing how adding /usr/sbin to default
user $PATH would break, and how merging /usr/sbin and /usr/bin would
break.

Which distributions?

Archlinux has had merged bin and sbin for a number of years. Fedora is
going in that direction soon and made a nice writeup on https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin

An interesting read, although some of the considerations do not seem to
apply to Debian.

For instance, as far as I can see, in Debian the superuser (root) gets
a different default $PATH (which includes sbin directories), with
respect to regular users (who, by default, do not have sbin directories
in their $PATH). Hence, I would say that the distinction between /bin
and /sbin is not meaningless in Debian...

I am not aware of any plans in Debian to move in that direction.

So far it has been briefly discussed in the -devel channel on IRC and
the idea has been received mostly well. There are bigger problems with
it, such as different packages having undeclared file conflicts if the sbinmerge happenen, however it is a nice low-hanging fruit to first fix
the few packages where the one package unpacks the same file (or
symlink) to both bin and sbin.

I see, but I am a bit worried of breaking scripts with hardcoded paths.

See the [usrmerge FAQ], which includes, in part:

You are correct, this is not about the current usrmerge. It could be called usrmerge2.0 or sbinmerge or some other term.

OK, let's call it sbinmerge, then.

Could you please elaborate a bit more on why you think this feature of
the apt-listbugs Debian package could be an issue?

On a filesystem where bin and sbin are merged, it causes an unpacking
error during installation of the package, due to the symlink trying to overwrite the real file, or the real file overwriting the symlink. It is
in a way a file conflict - it can be silenced by passing the right flags
to the commands, but it is better to fix it properly.

Sorry, I wasn't clear: I understand why unpacking conflicting files
across /sbin and /bin causes issues on a system where /sbin and /bin
are the same directory.

I was asking you to elaborate on why this could be an issue in Debian,
which does not currently support a layout where /sbin and /bin are the
same directory.
And the answer (judging from the rest of your reply) is basically
"because some people in Debian are considering the possibility to
merge /sbin and /bin in some unspecified future, and it would be nice,
if as few packages as possible hampered this possible transition".

Which other distributions (Debian-derivatives or otherwise) include apt-listbugs?

I don't know of any.

I am a bit hesitant to do so (risking to break random custom scripts), unless there's a good reason.

The idea of merging bin and sbin is exactly to help with random custom scripts, because if bin and sbin are the same directory, then it doesn't matter if only bin or only sbin is in $PATH, or if the executable is
called directly using hardcoded /usr/bin/apt-listbugs or /usr/sbin/listbugs, because both ways will then work instead of giving "command not found" errors.

However I agree that in the meantime some random script somewhere could break, and so such a change might warrant a NEWS entry.

Exactly, I am a bit worried about the meantime.

However, you replied to my questions (that's why I am dropping the
'moreinfo' tag).
It's now clear to me, that you are not asking me to modify apt-listbugs
for other distributions, but to simplify a possible future sbinmerge in
Debian.
That sounds like a legitimate feature request (hence severity
'wishlist').

I will think about it.
Bye!


--
http://www.inventati.org/frx/
There's not a second to spare! To the laboratory! ..................................................... Francesco Poli .
GnuPG key fpr == CA01 1147 9CD2 EFDF FB82 3925 3E1C 27E1 1F69 BFFE

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEygERR5zS79/7gjklPhwn4R9pv/4FAmXdE8kACgkQPhwn4R9p v/7YpQ//UOJh/8eG9IdgTqOixf6+CnmldCBKkDulAktq2ozm10zTBphjreRnNRfu MbadnEIbxdlZuc8E0H0TSHNz2zbqkG1TnPof6aVFiEa7ypRW5Noj0TUEvI+km5xZ dUFSR+HA7DN1ao3IfeRiJ3REp4p/5hUMkYPWzEfKVpPoXYEcdXyBFXSZHAczAZEo fHkuTWCD7dDGVOcnYAmnOcUcYeNZk0TesQhz2QPuvf2smwY/fw7lFAEhwbrVW9A5 Nc2sSL7wNG9rA7XVWeVY5AHFpqAsR0wu6xWHtL/YnmanFoFH8fCt/o55dVo8kxRv E9ARrRHbT77TX+E4TVuMMPG+HBQAGY55L2K52CToJA33K9dAanBGxVQ+H4slKdyb 1uVgscBmXCwSbWWZyy8FIfJljrmCN76acoc4KVMt7aCG43L2Bla+QAfkLCu1mw4/ FKV+/Huvk7kvRzHlPxXksyYxGlQRxMBmoZF2r352LoQORlZ/Qm0JClggFyUXmjMt C8l2mdLxNndi5HmE/aAzfNMGfRYK73wsaLuFzfEffyf0zSkkyTp5d+j1TRa8eFPr XdQ5tlYOPJF9mXIRjVZxnbQexnguVSYbe2vZpSpyv98W6gZxXnzX79CiUruI8Ti9 09btKd0AfilGOSqA/HVx0utXC39utWyA