chroot: you do not have write permission for PKGDEST /var/lib/repo/aur

[mqus]

I'm not sure if this is a bug (probably not since no one else has reported it yet):

If I update any AUR packages with chroot mode, I get the following error message:

paru-1.8.0-1: parsing pkg list...
error: failed to run: makepkg  --verifysource -Ccf: ==> ERROR: You do not have write permission for the directory $PKGDEST (/var/lib/repo/aur).
    Aborting...

(I already installed paru 1.8.0 via manual makepkg, this example is just for putting it into the localrepo).

The error message itself is a small bit misleading since makepkg is run with --packagelist and not the parameters shown in the message. I'll post a PR for that shortly.

From what I guessed in the code base this command is run to determine which output will be generated by makepkg, but since PKGDEST (the path where the built packages are put) is only writable by root it does not work. But why does it seem to work for anybody else? Why did it work before? (I actually don't know when it last worked, did not use that machine for some time, but I'm pretty sure it worked with paru 1.6.1 at least and I can't remember making any config changes)

Did I botch things somehow? How do I fix it?

More context:

complete paru output

$ paru -Syu
[sudo] password for mqus:
no new news
:: Synchronizing package databases...
 core is up to date
 extra is up to date
 community is up to date
 multilib is up to date
 aur is up to date
:: Looking for AUR upgrades
:: Looking for devel upgrades
:: paru: local (1.8.0-1) is newer than aur (1.6.1-1)
[...]
12 aur/paru                            1.6.1-1                -> 1.8.0-1
[...]
:: Packages to exclude (eg: 1 2 3, 1-3):
:: 1-11 13-24
:: Resolving dependencies...
:: Calculating conflicts...
:: Calculating inner conflicts...
:: marked out of date: giskismet
:: orphans: networkmanager-iodine-git

Aur (1) paru-1.8.0-1

:: Proceed to review? [Y/n]: 

:: Downloading PKGBUILDs...
 PKGBUILDs up to date
 nothing new to review
fetching devel info...
:: Synchronizing package databases...
 core is up to date
 extra is up to date
 community is up to date
 multilib is up to date
 aur is up to date
:: Starting full system upgrade...
 there is nothing to do
==> Synchronizing chroot copy [/var/lib/aurbuild/x86_64/root] -> [mqus]...done
:: Synchronizing package databases...
 core is up to date
 extra is up to date
 community is up to date
 multilib is up to date
 aur is up to date
:: Starting full system upgrade...
 there is nothing to do
==> Making package: paru 1.8.0-1 (Fri Aug  6 11:37:45 2021)
==> Retrieving sources...
  -> Downloading paru-1.8.0.tar.gz...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   124  100   124    0     0    507      0 --:--:-- --:--:-- --:--:--   506
100 7884k  100 7884k    0     0  5976k      0  0:00:01  0:00:01 --:--:-- 20.4M
==> Validating source files with sha256sums...
    paru-1.8.0.tar.gz ... Passed
==> Making package: paru 1.8.0-1 (Fri 06 Aug 2021 11:37:53 AM CEST)
==> Checking runtime dependencies...
==> Installing missing dependencies...
resolving dependencies...
looking for conflicting packages...

Package (4)           New Version  Net Change

extra/perl-error      0.17029-3      0.04 MiB
extra/perl-mailtools  2.21-5         0.11 MiB
extra/perl-timedate   2.33-3         0.08 MiB
extra/git             2.32.0-1      32.29 MiB

Total Installed Size:  32.52 MiB

:: Proceed with installation? [Y/n] 
(4/4) checking keys in keyring                                                    [###############################################] 100%
(4/4) checking package integrity                                                  [###############################################] 100%
(4/4) loading package files                                                       [###############################################] 100%
(4/4) checking for file conflicts                                                 [###############################################] 100%
(4/4) checking available disk space                                               [###############################################] 100%
:: Processing package changes...
(1/4) installing perl-error                                                       [###############################################] 100%
(2/4) installing perl-timedate                                                    [###############################################] 100%
(3/4) installing perl-mailtools                                                   [###############################################] 100%
(4/4) installing git                                                              [###############################################] 100%
Optional dependencies for git
    tk: gitk and git gui
    perl-libwww: git svn
    perl-term-readkey: git svn and interactive.singlekey setting
    perl-io-socket-ssl: git send-email TLS support
    perl-authen-sasl: git send-email TLS support
    perl-mediawiki-api: git mediawiki support
    perl-datetime-format-iso8601: git mediawiki support
    perl-lwp-protocol-https: git mediawiki https support
    perl-cgi: gitweb (web interface) support
    python: git svn & git p4
    subversion: git svn
    org.freedesktop.secrets: keyring credential helper
    libsecret: libsecret credential helper [installed]
:: Running post-transaction hooks...
(1/1) Warn about old perl modules
==> Checking buildtime dependencies...
==> Installing missing dependencies...
:: There are 2 providers available for cargo:
:: Repository extra
   1) rust
:: Repository community
   2) rustup

Enter a number (default=1): 
resolving dependencies...
looking for conflicting packages...

Package (3)      New Version     Net Change

core/libedit     20210522_3.1-1    0.27 MiB
extra/llvm-libs  12.0.1-2         98.38 MiB
extra/rust       1:1.54.0-1      475.32 MiB

Total Installed Size:  573.97 MiB

:: Proceed with installation? [Y/n] 
(3/3) checking keys in keyring                                                    [###############################################] 100%
(3/3) checking package integrity                                                  [###############################################] 100%
(3/3) loading package files                                                       [###############################################] 100%
(3/3) checking for file conflicts                                                 [###############################################] 100%
(3/3) checking available disk space                                               [###############################################] 100%
:: Processing package changes...
(1/3) installing libedit                                                          [###############################################] 100%
(2/3) installing llvm-libs                                                        [###############################################] 100%
(3/3) installing rust                                                             [###############################################] 100%
Optional dependencies for rust
    lldb: rust-lldb script
    gdb: rust-gdb script
==> Retrieving sources...
  -> Found paru-1.8.0.tar.gz
==> WARNING: Skipping all source file integrity checks.
==> Extracting sources...
  -> Extracting paru-1.8.0.tar.gz with bsdtar
==> Sources are ready.
paru-1.8.0-1: parsing pkg list...
error: failed to run: makepkg  --verifysource -Ccf: ==> ERROR: You do not have write permission for the directory $PKGDEST (/var/lib/repo/aur).
    Aborting...

:: Synchronizing package databases...
 core is up to date
 extra is up to date
 community is up to date
 multilib is up to date
 aur is up to date
:: Starting full system upgrade...
warning: paru: local (1.8.0-1) is newer than aur (1.6.1-1)
 there is nothing to do
error: packages failed to build: paru-1.8.0-1

paru.conf
pacman.conf

$ paru --version
paru v1.8.0 - libalpm v13.0.0

user rights for directories:

$ ls -lad /var/lib/repo/aur /var/lib/aurbuild/x86_64/{root,mqus} ~/.cache/paru{,/*}
drwxr-xr-x  3 mqus mqus    4096 26. Mai 03:09 /home/mqus/.cache/paru
drwxr-xr-x 22 mqus mqus    4096  6. Aug 10:49 /home/mqus/.cache/paru/clone
-rw-r--r--  1 mqus mqus       2  6. Aug 12:41 /home/mqus/.cache/paru/devel.json
-rw-r--r--  1 mqus mqus 1200483  6. Aug 02:32 /home/mqus/.cache/paru/packages.aur
drwxr-xr-x 22 root root    4096  6. Aug 12:42 /var/lib/aurbuild/x86_64/mqus
drwxr-xr-x 16 root root    4096  6. Aug 12:42 /var/lib/aurbuild/x86_64/root
drwxr-xr-x  2 root root   12288  6. Aug 10:46 /var/lib/repo/aur

[Morganamilo]

A while ago there was a change that local repos now must be writable by user. There's normally a warning for this if repo add fails but looks like that didn't trigger for some reason.

[mqus]

Isn't this a security risk?

Not a big one, since the packages have to be installed with root access afterwards anyway, but still.

[Morganamilo]

Just make sure it's your user that has perms for the repo, either via a group or owning it. Don't make it world writable.

[mqus]

well but its also my user that browses, uses applications, downloads stuff from the web etc. So from that viewpoint it's pretty much world-writable anyways, until I set up a separate user for updating my system. Thats somewhat inconvenient for me.

Just out of curiosity: Is the writability only needed for the makepkg --packagelist and moving the packages afterwards or for more?

[Morganamilo]

It's so packages and repos can be signed as your user.