Dear Maintainer,

   * What led up to the situation?

   Trying to install opam without recommended dependencies. Here is the
   command I used:

   sudo apt-get install -y --no-install-recommends opam

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

   Once installed, to be usable, opam needs to be initialized. Here is
   the command:

   opam init


   * What was the outcome of this action?

   Failure. Here is the full output (answering yes to all the questions)

$ opam init
No configuration file found, using built-in defaults.
Checking for available remotes: none.
  - you won't be able to use rsync and local repositories unless you install
    the rsync command on your system.
  - you won't be able to use git repositories unless you install the git
    command on your system.
  - you won't be able to use mercurial repositories unless you install the hg
    command on your system.
  - you won't be able to use darcs repositories unless you install the darcs
    command on your system.

[ERROR] Sandboxing is not working on your platform debian:
        "~/.opam/opam-init/hooks/sandbox.sh build sh -c echo SUCCESS
        >$TMPDIR/opam-sandbox-check-out && cat $TMPDIR/opam-sandbox-check-out;
        rm -f $TMPDIR/opam-sandbox-check-out" exited with code 1 "bwrap: No
        permissions to create new namespace, likely because the kernel does not
        allow non-privileged user namespaces. See <https://deb.li/bubblewrap>
        or <file:///usr/share/doc/bubblewrap/README.Debian.gz>."
Do you want to disable it?  Note that this will result in less secure package
builds, so please ensure that you have some other isolation mechanisms in place
(such as running within a container or virtual machine). [y/N]
anonymous@ed86d6201383:~$ opam init
No configuration file found, using built-in defaults.
Checking for available remotes: none.
  - you won't be able to use rsync and local repositories unless you install
    the rsync command on your system.
  - you won't be able to use git repositories unless you install the git
    command on your system.
  - you won't be able to use mercurial repositories unless you install the hg
    command on your system.
  - you won't be able to use darcs repositories unless you install the darcs
    command on your system.

[ERROR] Sandboxing is not working on your platform debian:
        "~/.opam/opam-init/hooks/sandbox.sh build sh -c echo SUCCESS
        >$TMPDIR/opam-sandbox-check-out && cat $TMPDIR/opam-sandbox-check-out;
        rm -f $TMPDIR/opam-sandbox-check-out" exited with code 1 "bwrap: No
        permissions to create new namespace, likely because the kernel does not
        allow non-privileged user namespaces. See <https://deb.li/bubblewrap>
        or <file:///usr/share/doc/bubblewrap/README.Debian.gz>."
Do you want to disable it?  Note that this will result in less secure package
builds, so please ensure that you have some other isolation mechanisms in place
(such as running within a container or virtual machine). [y/N] y

<><> Fetching repository information ><><><><><><><><><><><><><><><><><><><><><>
[ERROR] Could not update repository "default": OpamDownload.Download_fail(_,
        "Download command failed: \"/usr/bin/wget --content-disposition -t 3 -O
        /tmp/opam-833-815fca/index.tar.gz.part -U opam/2.1.2 --
https://opam.ocaml.org/index.tar.gz\" exited with code 5 \"ERROR: The
        certificate of 'opam.ocaml.org' doesn't have a known issuer.\"")
[ERROR] Initial download of repository failed.

   * What outcome did you expect instead?

   Exit success after some time and more output with the following last
   two lines:

Done.
# Run eval $(opam env --switch=default) to update the current shell environment

   * Additional notes

   ca-certificates listed in the report as installed because it was
   pulled by the reportbug tool itself.

   I found this when trying to install opam in a debian container. In
   such a context the option --disable-sandboxing should be passed to
   opam init in order to remove warnings.

   In order to avoid being asked question options -ya should be passed
   to opam init

Hi,

Le 10/05/2023 à 09:04, Cuihtlauac ALVARADO a écrit :

Indeed, the default repository is on HTTPS. However, if you have a local
copy of the repository,

   opam init --bare --disable-sandboxing default /path/to/repository

works without ca-certificates. So there exists a way to use opam without
this package, hence the Recommends (I suppose, I didn't make the initial
packaging myself). And by default, Recommends are installed, so opam
with default settings works in Debian with default settings.

Similarly, git only recommends ca-certificates, and fails when cloning
from HTTPS without it.


Cheers,

I agree you have a valid point, your reasoning makes sense. However,
it seems to me that by the same reasoning bubblewrap should be turned
into a recommended dependency too. Your command

   opam init --bare --disable-sandboxing default /path/to/repository

also works if bubblewrap is forcefully removed (and the dependencies
broken, for the sake of the example). Therefore, there exists a way to
use opam without bubblewrap, it could be recommended only.

Both reasoning look like having an issue: you assume the presence of a
local copy of the repository, I assume sandbox disabling is
acceptable. To me, the latter seems less unusual than the former:
sandbox disabling happens in (unprivileged) containers while local
repository copy seems to be for air gapped operation. Also, local git
clone seems far less unusual than package management without
networking.

Le 10/05/2023 à 11:15, Cuihtlauac Alvarado a écrit :

I agree, and I am more willing to demote bubblewrap to Recommends than
promote ca-certificates to Depends.


Cheers,