opam caused a significant portion of my home directory to be deleted

[varkor]

It's not entirely clear exactly what happened, as most of my files have been lost, and my programs corrupted, but I have the log from right before the problem occurred:

> opam init --no-setup --compiler=4.02.3
OPAM has already been initialized.Your system compiler has been changed. Do you want to upgrade your OPAM installation ? [Y/n] Y

=-=- Upgrading system -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  🐫 
The following actions will be performed:
  ∗  install conf-gtksourceview 2      
  ∗  install camlp5             7.03   
  ∗  install conf-m4            1      
  ∗  install base-threads       base   
  ∗  install base-unix          base   
  ∗  install base-bigarray      base   
  ∗  install depext             1.0.5  
  ∗  install ocamlfind          1.7.3-1
  ∗  install num                1.1    
  ∗  install lablgtk            2.18.6 
===== ∗  10 =====

=-=- Gathering sources =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  🐫 
[camlp5] Archive in cache
[depext] Archive in cache
[lablgtk] Archive in cache
[num] Archive in cache
[ocamlfind] Archive in cache

=-=- Processing actions -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  🐫 
∗  installed base-bigarray.base
∗  installed base-threads.base
∗  installed base-unix.base
∗  installed conf-m4.1
∗  installed conf-gtksourceview.2
[ERROR] The compilation of camlp5 failed at "./configure --prefix ~/.opam/system -libdir ~/.opam/system/lib -mandir
        ~/.opam/system/man".
∗  installed depext.1.0.5
∗  installed ocamlfind.1.7.3-1
[ERROR] The compilation of num failed at "make findlib-install".
∗  installed lablgtk.2.18.6
[ERROR] User interruption

I'm fairly sure it was executing make uninstall camlp5 before I killed it after noticing that it was taking an unexpected amount of time (so maybe the problem is there), though I think the issue is relevant here regardless.
I'm still a little in shock at having ruined my computer at the moment, so I may try to look into this a little more later, but I think this issue definitely needs to be looked into.

[varkor]

Okay, this seems to have been the issue: camlp5/camlp5#18
I think something is out of date here, because this issue was fixed a few days ago, but it occurred for me. This might not be the right repository, but any tools that depend on the outdated version need to be updated immediately.

Edit: The dependency might be updated now? I'm not sure how to double-check. It's possible I was using a version that missed the fix by a day or so.

[AltGr]

I am very sorry for this outcome, and feel for you. I am hoping you had backups or online versions of any valuable files 😢

opam will only run commands within ~/.opam, however, commands from package scripts (e.g. install and remove) are not sandboxed at the moment¹; so it's likely that a poorly written Makefile triggered the disaster. We'll search for it and fix it asap.

Again, I am very sorry this happened to you 😞

¹ We do have optional sandboxing, but it is still being tested and needs some manual configuration. The upcoming pam 2 can also automatically take care of package uninstallation.

[AltGr]

Indeed, it seems it had been fixed. opam doesn't auto-update, unfortunately, so without running opam update, it wouldn't have known about the latest update of the package :(

[varkor]

Seems like a case of very unfortunate bad timing. It seems also like there will be mitigations to prevent this sort of thing happening in opam in the future, so I think there's nothing more to be said here. Thanks for looking into it!

[nerpderp83]

Every file owned by my user account is gone from my system (~400G of data).

I can open another ticket if need be. @AltGr @varkor

It seems opam will update/upgrade if you compiler version changes. I upgraded ocaml from 4.06.0 to 4.06.1 and it nuked my home directory. I am sad.

$ brew upgrade ocaml
==> Upgrading 1 outdated package, with result:
ocaml 4.06.0 -> 4.06.1
==> Upgrading ocaml 
==> Downloading https://homebrew.bintray.com/bottles/ocaml-4.06.1.sierra.bottle.tar.gz
######################################################################## 100.0%
==> Pouring ocaml-4.06.1.sierra.bottle.tar.gz
🍺  /usr/local/Cellar/ocaml/4.06.1: 1,989 files, 225.8MB

$ opam init
OPAM has already been initialized.Your system compiler has been changed. Do you want to upgrade your OPAM installation ? [Y/n] Y

=-=- Upgrading system -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  🐫 
The following actions will be performed:
  ∗  install camlp5        7.03    
  ∗  install conf-m4       1       
  ∗  install base-threads  base    
  ∗  install ocamlbuild    0.12.0  
  ∗  install base-unix     base    
  ∗  install base-bigarray base    
  ∗  install ocamlfind     1.7.3-1 
  ∗  install menhir        20171222
===== ∗  8 =====

=-=- Gathering sources =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  🐫 
[camlp5] Archive in cache
[menhir] Archive in cache
[ocamlbuild] Archive in cache
[ocamlfind] Archive in cache

=-=- Processing actions -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  🐫 
∗  installed base-bigarray.base
∗  installed base-threads.base
∗  installed base-unix.base
∗  installed conf-m4.1
[ERROR] The compilation of camlp5 failed at "./configure --prefix /Users/seanj/.opam/system -libdir /Users/seanj/.opam/system/lib -mandir
        /Users/seanj/.opam/system/man".
∗  installed ocamlfind.1.7.3-1
∗  installed ocamlbuild.0.12.0
∗  installed menhir.20171222

422G Free it was 19G free 1.5hrs ago. :(

[AltGr]

oh noh! I can't express how sorry I am about this.