From: Sebastien Marie <semarie@kapouay.eu.org>
Subject: Re: patch: xenocara/fonts/alias: avoid chown dance around fc-cache invocation
To: Theo de Raadt <deraadt@openbsd.org>
Cc: tech@openbsd.org, Matthieu Herrb <matthieu@herrb.eu>
Date: Sun, 17 May 2026 19:41:12 +0200

"Theo de Raadt" <deraadt@openbsd.org> writes:

> I wish you had explained the mechanism, here it is:

well, it was in the diff...

>
> +	su -s /bin/ksh _fc-cache -c \
> +	   "fc-cache -y ${DESTDIR} -s -v /usr/X11R6/lib/X11/fonts" ;\
>
> I'm not a fan of the build infrastructure using su to additional
> users.

It changes from using:

  chown ${BUILDUSER}:${WOBJGROUP} ${DESTDIR}/var/cache/fontconfig;
  su ${BUILDUSER} -c "fc-cache -y ${DESTDIR} -s -v /usr/X11R6/lib/X11/fonts" ;
  chown -R _fc-cache:_fc-cache ${DESTDIR}/var/cache/fontconfig/;
  chmod 644 ${DESTDIR}/var/cache/fontconfig/*;

to just a simpler "generate using the right user at first"

The part which bother me is the last `chown -R` + `chmod 644 *`, but I
could understand avoiding using su(1) for others users in build infra.

I am just not fan of giving all the files in a whole directory to a user
(specially with -R). I assume the `chmod 644` is enough to clean any
problematic files in ${DESTDIR}/var/cache/fontconfig .

Regards.
-- 
Sebastien Marie