type: tree creates issues in deb packages

[agarof]

What happened?

Creating a deb package containing a directory using type: tree causes issues with the package on Ubuntu.

On Ubuntu 20 and 22, opening the package with Software Install fails with the error message `Failed to install file: not supported.

On Ubuntu 24, App Center opens and installs the package without issues.

On all three Ubuntu versions, gdebi reports List of files for 'package.deb' could not be read in the Included files tab.

How can we reproduce this?

Create a directory containing a single file using mkdir directory && echo content > directory/file.
Generate a deb package using the following config file

name: package
maintainer: Test
contents:
  - src: directory
    dst: /var/lib/directory
    type: tree

The package will have the issues described above. However, a package generated with the following will not

name: package
maintainer: Test
contents:
  - src: directory/file
    dst: /var/lib/directory/file

nfpm version

_____ ____  __  __
 _ __ |  ___|  _ \|  \/  |
| '_ \| |_  | |_) | |\/| |
| | | |  _| |  __/| |  | |
|_| |_|_|   |_|   |_|  |_|
nfpm: a simple and 0-dependencies apk, arch linux, deb, ipk, and rpm packager written in Go
https://nfpm.goreleaser.com

GitVersion:    2.40.0
GitCommit:     db338d012a43be3c7f9c5a450eca2e279c973de4
GitTreeState:  false
BuildDate:     2024-08-29T11:36:48Z
BuiltBy:       goreleaser
GoVersion:     go1.23.1
Compiler:      gc
ModuleSum:     h1:M6WaaHeTCgNopUo9e8zgeHlOiN65LZAKqogzCJXBwYQ=
Platform:      linux/amd64

Search

• I did search for other open and closed issues before opening this.

Code of Conduct

• I agree to follow this project's Code of Conduct

Additional context

The problem seems to come from the data.tar archive's format. The issue affects the package regardless of compression setting and decompressing and recompressing it does not solve the issue.
However, extracting the tar archive and recreating it creates a working package.

[erikgeiser]

Sorry for the late reply.

It seems like apt is able to install both packages without issue on Ubuntu 22 and 24. Unfortunately I don't have an Ubuntu 22 available atm, so I could not reproduce the issue with the graphical installers.

Still, I thought the possible causes. Without tree, the directories will be implicitly created. With tree only /var and /var/lib are implicitly created and /var/lib/destination is created based on the real directory. As a result, the tar header of /var/lib/directory contains both the permission bits as well as directory flag 0x80000000. I think the tar header normally shouldn't include the directory flag, as the file type is already specified by the type flag of the tar header.

I think the problem may be solved by removing the following lines (my comment there is not true (anymore?!)):

nfpm/deb/deb.go

Lines 441 to 443 in 9708afd

	// tar.FileInfoHeader only uses file.Mode().Perm() which masks the mode with
	// 0o777 which we don't want because we want to be able to set the suid bit.
	header.Mode = int64(file.Mode())

Before removing the lines, we should test this hypothesis on Ubuntu 22 first.

[caarlos0]

hmm interesting hypothesis, and I think it makes sense... I'll try to test this with docker sometime this week.

[erikgeiser]

As far as I understood it, it only affects graphical package managers. I was able to install it just fine with apt using Docker images for Ubuntu 22.

[erikgeiser]

I was able to reproduce the issue and my hunch ended up being correct, but it requires some additional changes.