carthage: Failure during destroot, due to not dropping privs

[cbarrett (Colin Barrett)]

When running sudo port install carthage:

:notice:destroot --->  Staging carthage into destroot
:debug:destroot Can't run destroot under sudo without elevated privileges (due to mtree).
:debug:destroot Run destroot without sudo to avoid root privileges.
:debug:destroot Going to escalate privileges back to root.
:debug:destroot euid changed to: 0. egid changed to: 0.

This causes the call to :info:destroot git submodule update --init --recursive to fail with, e.g.

:info:destroot Cloning into '/opt/local/var/macports/build/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_devel_carthage/carthage/work/Carthage-0.18.1/Carthage/Checkouts/Commandant'...
:info:destroot fatal: unable to access 'https://github.com/Carthage/Commandant.git/': SSL certificate problem: Couldn't understand the server certificate format

Sure enough, sandboxing violations like in #50469

default	15:09:52.374632 -0500	kernel	SandboxViolation: git-remote-http(70759) deny(1) file-write-data /private/var/db/mds/system/mds.lock

My config doesn't have macportsuser root in it, or anything like that from the other ticket.

Perhaps whatever's causing ports to run mtree (I haven't looked in detail there yet) should drop privs afterwards? I'm going to keep digging—years and years ago I was a contributor! :)

[cbarrett (Colin Barrett)]

Oops, apologies, the title should be "due to not dropping privs"

[mf2k (Frank Schima)]

In the future, please Cc the port maintainers (port info --maintainers carthage), if any.

[seanfarley (Sean Farley)]

No idea. Sounds like this happens for any port that does a git clone?

[raimue (Rainer Müller)]

This report does not make a lot of sense to me and I cannot reproduce the problem. Why would base be fetching with 'git clone' during destroot? There is no indication of that in the port...

Could you provide step by step instructions that show how to reproduce the problem?

[schwerdf (August Schwerdfeger)]

Log of unsuccessful Carthage install attempt.

[schwerdf (August Schwerdfeger)]

I am getting a similar error when trying to install Carthage. I ran sudo port install carthage on an essentially clean installation of MacPorts under Sierra, and it failed on an attempt to clone a Git repository. I have attached the full log from the run.

[seanfarley (Sean Farley)]

fatal: unable to access 'https://github.com/thoughtbot/Argo.git/': SSL certificate problem: Couldn't understand the server certificate format ... so something is off with certs?

[breun (Nils Breunese)]

I ran into that error message once and it ended up not having anything to do with certificates. Maybe you've got the same issue: #50469

[seanfarley (Sean Farley)]

Looking at the linked issue, it seems that this is now fixed.

[ryandesign (Ryan Carsten Schmidt)]

It will be fixed in MacPorts 2.4.3.