UNPRIVILEGED_GROUPS and openjdk builds?

[Paul Ripke <stix%stix.id.au@localhost>]

I've tripped over this since at least openjdk17, and again on openjdk21
where 'make build' appears to complete fine, but actually only
completes the first part of the build. A 'make stage-install' then
fails due to directory not found:

=> Creating installation directories
/usr/bin/install -d -o stix -g users -m 755 /home/tmp/pkgwrk/lang/openjdk21/work/.destdir/usr/pkg/java/openjdk21
cd /home/tmp/pkgwrk/lang/openjdk21/work/jdk21u-jdk-21.0.3-9-1/build/bsd-x86_64-server-release/images/jdk && pax -rwpp .          /home/tmp/pkgwrk/lang/openjdk21/work/.destdir/usr/pkg/java/openjdk21/.
cd: can't cd to /home/tmp/pkgwrk/lang/openjdk21/work/jdk21u-jdk-21.0.3-9-1/build/bsd-x86_64-server-release/images/jdk
*** Error code 2

I've debugged this down to the fact that my build user is in a bunch of
groups, and this appears to somehow muck up MAKEFLAGS. Setting
'UNPRIVILEGED_GROUPS=users' fixes this, and the build completes fully.

I'm at a loss as to where and how exactly this breaks, but I assume
there's an improvement that can be made somewhere.

E.g., in lang/openjdk21:

- Default, 'make build' succeeds, but doesn't fully build.

ksh$ make show-var VARNAME=MAKEFLAGS
_MAKE=/usr/bin/make NATIVE_OPSYS=NetBSD NATIVE_OS_VERSION=10.0_STABLE NATIVE_OPSYS_VERSION=100000 HOST_MACHINE_ARCH=amd64 NATIVE_LOWER_OPSYS=netbsd _PKGSRCDIR=/usr/pkgsrc PKGTOOLS_VERSION=20210410 _CC=/usr/bin/gcc PKG_BUILD_OPTIONS.freetype2=\ brotli\ png PKG_BUILD_OPTIONS.libcups=\ dbus\ dnssd\ kerberos PKG_BUILD_OPTIONS.heimdal=\ inet6\ kerberos-prefix-cmds PKG_BUILD_OPTIONS.sqlite3=\ fts PKG_BUILD_OPTIONS.gnutls=\ pkcs11 UNPRIVILEGED_USER=stix UNPRIVILEGED_GROUP=users UNPRIVILEGED_GROUPS=users\ wheel\ operator\ nvmm\ squid\ cvsadmin _PATH_ORIG=/home/stix/bin:/home/stix/bin/NetBSD.x86_64:/sbin:/usr/sbin:/bin:/usr/bin:/usr/games:/usr/pkg/sbin:/usr/pkg/bin:/usr/local/bin:/usr/X11R7/bin:/etc:/usr/pkg/java/openjdk17/bin:/usr/pkg/py39-google-cloud-sdk/bin

- Setting UNPRIVILEGED_GROUPS to a single group allows it to succeed:

ksh$ make UNPRIVILEGED_GROUPS=users show-var VARNAME=MAKEFLAGS
_MAKE=/usr/bin/make NATIVE_OPSYS=NetBSD NATIVE_OS_VERSION=10.0_STABLE NATIVE_OPSYS_VERSION=100000 HOST_MACHINE_ARCH=amd64 NATIVE_LOWER_OPSYS=netbsd _PKGSRCDIR=/usr/pkgsrc PKGTOOLS_VERSION=20210410 _CC=/usr/bin/gcc PKG_BUILD_OPTIONS.freetype2=\ brotli\ png PKG_BUILD_OPTIONS.libcups=\ dbus\ dnssd\ kerberos PKG_BUILD_OPTIONS.heimdal=\ inet6\ kerberos-prefix-cmds PKG_BUILD_OPTIONS.sqlite3=\ fts PKG_BUILD_OPTIONS.gnutls=\ pkcs11 UNPRIVILEGED_USER=stix UNPRIVILEGED_GROUP=users _PATH_ORIG=/home/stix/bin:/home/stix/bin/NetBSD.x86_64:/sbin:/usr/sbin:/bin:/usr/bin:/usr/games:/usr/pkg/sbin:/usr/pkg/bin:/usr/local/bin:/usr/X11R7/bin:/etc:/usr/pkg/java/openjdk17/bin:/usr/pkg/py39-google-cloud-sdk/bin

- Strangely, setting UNPRIVILEGED_GROUPS explicitly to multiple groups
also succeeds:

ksh$ make 'UNPRIVILEGED_GROUPS=users wheel operator' show-var VARNAME=MAKEFLAGS
_MAKE=/usr/bin/make NATIVE_OPSYS=NetBSD NATIVE_OS_VERSION=10.0_STABLE NATIVE_OPSYS_VERSION=100000 HOST_MACHINE_ARCH=amd64 NATIVE_LOWER_OPSYS=netbsd _PKGSRCDIR=/usr/pkgsrc PKGTOOLS_VERSION=20210410 _CC=/usr/bin/gcc PKG_BUILD_OPTIONS.freetype2=\ brotli\ png PKG_BUILD_OPTIONS.libcups=\ dbus\ dnssd\ kerberos PKG_BUILD_OPTIONS.heimdal=\ inet6\ kerberos-prefix-cmds PKG_BUILD_OPTIONS.sqlite3=\ fts PKG_BUILD_OPTIONS.gnutls=\ pkcs11 UNPRIVILEGED_USER=stix UNPRIVILEGED_GROUP=users _PATH_ORIG=/home/stix/bin:/home/stix/bin/NetBSD.x86_64:/sbin:/usr/sbin:/bin:/usr/bin:/usr/games:/usr/pkg/sbin:/usr/pkg/bin:/usr/local/bin:/usr/X11R7/bin:/etc:/usr/pkg/java/openjdk17/bin:/usr/pkg/py39-google-cloud-sdk/bin

-- 
Paul Ripke
"Great minds discuss ideas, average minds discuss events, small minds
 discuss people."
-- Disputed: Often attributed to Eleanor Roosevelt. 1948.