Re: Unprivileged build user

[abs%absd.org@localhost]

On Wednesday, 19 August 2026 at 09:25, Jonathan Perkin <jperkin%pkgsrc.org@localhost> wrote:

> Greg requested that bob use PKG_USERS to create an unprivileged builder
> user by default, which seems entirely reasonable.
>
> I'd like to go one step further and settle on a standard unprivileged
> build user that bob, pbulk, and potentially others in the future can
> all use.  pbulk has shipped this:
>
>    # Account used for user-destdir builds. This account should have
>    # no special permissions.
>    #
>    unprivileged_user=pbulk
>
> in its default pbulk.conf for many years, without creating PKG_USERS,
> and so I expect others may be like me and currently re-use the pbulk
> user or similar that they've previously created for pbulk, for bob.
>
> What I propose is that we add a standard:
>
>    PKGBUILD_USER?=	pkgbuild
>    PKGBUILD_GROUP?=	pkgbuild
>
> to mk/defaults/mk.conf, and then update both pbulk and bob to use this
> for their default PKG_USERS/PKG_GROUPS.
>
> I would then add a small bit of SUBST in bob to correctly populate this
> in the generated config.lua so that unprivileged builds work out of the
> box for new users.  As an existing user I'd be happy to modify my
> existing host setups to match this.
>
> Any particular grievances about this before I go ahead?

Would it be worth changing the pbulk variable from unprivileged_user so someone updating pbulk without updating their conf can get a more helpful error diagnostic?

Either way, I think its a good change

David