File ownership in the deb package

[li-yq]

Bug description

In the deb package, the /opt/quarto is owned by the GitHub action runner UID/GID (1001:123) instead of root.

Steps to reproduce

Download and install quarto-1.4.550-linux-amd64.deb, then

$ ls /opt/quarto -ldn
drwxr-xr-x 4 1001 123 4096 Feb  7  2023 /opt/quarto

Expected behavior

The files should be owned by root.

Actual behavior

The files are owned by UID 1001.

Your environment

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.3 LTS"

Quarto check output

N/A

[cderv]

Thanks for the report. We can also see like this the current bundled owner and group

$ curl -L -O https://github.com/quarto-dev/quarto-cli/releases/download/v1.4.550/quarto-1.4.550-linux-amd64.deb
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  111M  100  111M    0     0  16.6M      0  0:00:06  0:00:06 --:--:-- 20.7M
$ dpkg-deb --contents quarto-1.4.550-linux-amd64.deb
drwxr-xr-x runner/docker     0 2024-02-15 15:37 ./
drwxr-xr-x runner/docker     0 2024-02-15 15:37 ./opt/
drwxr-xr-x runner/docker     0 2024-02-15 15:37 ./opt/quarto/
<truncated>

[li-yq]

Also noticed that the tarball has the same owner and group:

$ curl -Ls https://github.com/quarto-dev/quarto-cli/releases/download/v1.4.550/quarto-1.4.550-linux-amd64.tar.gz | tar tzv | head
drwxr-xr-x runner/docker     0 2024-02-15 22:36 quarto-1.4.550/
drwxr-xr-x runner/docker     0 2024-02-15 22:37 quarto-1.4.550/share/
drwxr-xr-x runner/docker     0 2024-02-15 22:36 quarto-1.4.550/share/lua-plugin/
-rw-r--r-- runner/docker  3191 2024-02-15 22:36 quarto-1.4.550/share/lua-plugin/plugin.lua
drwxr-xr-x runner/docker     0 2024-02-15 22:36 quarto-1.4.550/share/editor/
drwxr-xr-x runner/docker     0 2024-02-15 22:36 quarto-1.4.550/share/editor/tools/
-rw-r--r-- runner/docker 2439046 2024-02-15 22:36 quarto-1.4.550/share/editor/tools/vs-code.mjs
-rw-r--r-- runner/docker   16656 2024-02-15 22:36 quarto-1.4.550/share/editor/tools/attrs.yml
drwxr-xr-x runner/docker       0 2024-02-15 22:36 quarto-1.4.550/share/editor/tools/yaml/
-rw-r--r-- runner/docker 2486845 2024-02-15 22:37 quarto-1.4.550/share/editor/tools/yaml/web-worker.js

[cderv]

This is the same for our tar.gz bundle, though when uncompressing this should be corrected to the user doing the tar xvz command, as --no-same-owner is the default when extracted.

‘--no-same-owner’
‘-o’
When extracting an archive, do not attempt to preserve the owner specified in the tar archive. This the default behavior for ordinary users.

We could correct to root/root when compressing though by setting --owner=root --group=root