"Theo de Raadt" <deraadt@openbsd.org> writes:

> I wish you had explained the mechanism, here it is:

well, it was in the diff...

>
> +	su -s /bin/ksh _fc-cache -c \
> +	   "fc-cache -y ${DESTDIR} -s -v /usr/X11R6/lib/X11/fonts" ;\
>
> I'm not a fan of the build infrastructure using su to additional
> users.

It changes from using:

  chown ${BUILDUSER}:${WOBJGROUP} ${DESTDIR}/var/cache/fontconfig;
  su ${BUILDUSER} -c "fc-cache -y ${DESTDIR} -s -v /usr/X11R6/lib/X11/fonts" ;
  chown -R _fc-cache:_fc-cache ${DESTDIR}/var/cache/fontconfig/;
  chmod 644 ${DESTDIR}/var/cache/fontconfig/*;

to just a simpler "generate using the right user at first"

The part which bother me is the last `chown -R` + `chmod 644 *`, but I
could understand avoiding using su(1) for others users in build infra.

I am just not fan of giving all the files in a whole directory to a user
(specially with -R). I assume the `chmod 644` is enough to clean any
problematic files in ${DESTDIR}/var/cache/fontconfig .

Regards.
-- 
Sebastien Marie