VINYL_STATE_DIR revisited (…and its creation)

[Oliver Schmidt]

Hi,

I am one of the NixOS maintainers for the vinyl-cache package, and while packaging the 9.0.1 release a while ago I stumbled over a few details regarding the VINYL_STATE_DIR changes that confuse me. So I'd like to follow up on https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/issues/4477 here.
First of all, changing such important data location defaults in a minor security patch release is not great from a packager's point of view. But that happened, let's move on.

## state dir creation during install phase

For packaging vinyl-cache in nixpkgs, I had to patch out the changed install-data-local phase [1], as it now tries to create that (potentially external) state dir during the install phase of the package build process.
Admittedly Nix packaging happening in a sandbox is special in its own way, but even classic packaging of rpm and deb packaging nowadays happens sandboxed. So creating the statedir at _build time_ does in no way ensure the directory to be present in the actual system installing such a package later on.
For backwards-compatibility I decided to keep `"--with-statedir=/run"`, so the rule attempted to mkdir within the /run/ directory which of course failed in the sandbox. But even with the new default location in /var/lib/ creating directories during packaging has the same issues, right?
In the meantime, that makefile target has slightly changed and is now prefixed with DESTDIR, but the general issue remains.

I'd like to understand your reasoning behind that Makefile decision and work on a solution that allows building in the Nix sandbox with a custom statedir and avoids patching the makefile.

## state dir moved to /various/lib: memory-backed?

I remember that having the VINYL_STATE_DIR on a RAM-backed filesystem used to be very important for performance. Is this still the case? I could not find any concrete statement on that in the docs anymore.
Due to this, the decision to move the default state dir to /var/lib/ surprises me. Citing FHS considerations only make sense as long as that directory does not need to be memory-backed, because a normal FHS-compliant /var/lib/ is seldomly on memory-backed storage. And if we have to resort to stunts like @rfc1036 proposed

> My plan for the Debian vinyl-cache package is to ship a systemd unit like vinyl-cache-workdir.mount which will mount an appropriate tmpfs on /var/lib/vinyl-cache/vinyld/.

then FHS and the needs of vinyld are kind of orthogonal. On NixOS we already let systemd manage the state dir presence despite keeping it in /run/ (/var/run/ is a symlink to that on systemd-based distros).
The noexec considerations on Debian systems regarding /var/run/ are valid though, the question then is whether Debian is the special case here and needs to handle this downstream, or whether everyone else needs to.

Best regards
osnyx

PS: Is anyone willing to provide me a signup token for code.vinyl-cache.org <http://code.vinyl-cache.org/>?

[1] https://github.com/flyingcircusio/nixpkgs/blob/6dfb871fdcb1e4f39bb913876cf5e2ea1b1673fe/pkgs/servers/vinyl-cache/0001-Makefile-do-not-create-VINYL_STATE_DIR.patch

-- 
Dipl.-Inf. Oliver Schmidt · os at flyingcircus.io · Systems Engineer · Pronomen er/he
Flying Circus Internet Operations GmbH · https://flyingcircus.io
Leipziger Str. 70/71 · 06108 Halle (Saale) · Deutschland
HR Stendal HRB 21169 · Geschäftsführer: Christian Theune, Christian Zagrodnick