Permission warnings/errors installing packages within (only) updated archlinux:base-devel containers?

[AndydeCleyre]

With Arch's packages updated, I'm getting many permissions warnings/errors during package installations, most of which are like:

warning: warning given when extracting /usr/lib/git-core/git-show (Can't set permissions to 0777)
warning: warning given when extracting /usr/lib/git-core/git-show-branch (Can't set permissions to 0777)
warning: warning given when extracting /usr/lib/git-core/git-show-index (Can't set permissions to 0777)
warning: warning given when extracting /usr/lib/git-core/git-show-ref (Can't set permissions to 0777)

This can be reproduced for me locally on Ubuntu 22.04, as well as the corresponding GitHub Actions runner, with buildah 1.23.1.

repro.sh:

#!/bin/sh -ex

ctnr="${1:-ctnr}"

buildah from --name "$ctnr" docker.io/library/archlinux:base-devel
buildah run "$ctnr" pacman-key --init
buildah run "$ctnr" pacman -Sy
buildah commit --rm "$ctnr" "localhost/${ctnr}-ready"

buildah from --name "$ctnr" "localhost/${ctnr}-ready"
buildah run "$ctnr" pacman --noconfirm -S git
# No permissions errors
buildah rm "$ctnr"

buildah from --name "$ctnr" "localhost/${ctnr}-ready"
buildah run "$ctnr" pacman --noconfirm -Su
buildah run "$ctnr" pacman --noconfirm -S git
# Yes permissions errors
buildah rm "$ctnr"

The Arch packages updated during my latest repro are as follows:

Package	Old Version	New Version
acl	2.3.1-3	2.3.2-1
archlinux-keyring	20231222-1	20240208-1
attr	2.5.1-3	2.5.2-1
audit	3.1.2-1	4.0-1
autoconf	2.71-4	2.72-1
bash	5.2.021-1	5.2.026-2
binutils	2.41-3	2.42-2
ca-certificates-mozilla	3.96.1-1	3.98-1
coreutils	9.4-2	9.4-3
cryptsetup	2.6.1-3	2.7.0-1
curl	8.5.0-1	8.6.0-3
dbus	1.14.10-1	1.14.10-2
dbus-broker	---	35-2
dbus-broker-units	---	35-2
device-mapper	2.03.22-2	2.03.23-1
expat	2.5.0-1	2.6.0-1
fakeroot	1.32.2-1	1.33-2
filesystem	2023.09.18-1	2024.01.19-1
gc	8.2.4-1	8.2.6-1
gcc	13.2.1-3	13.2.1-5
gcc-libs	13.2.1-3	13.2.1-5
glib2	2.78.3-1	2.78.4-1
glibc	2.38-7	2.39-1
gnupg	2.4.3-2	2.4.4-1
gnutls	3.8.2-1	3.8.3-1
hwdata	0.377-1	0.379-1
iana-etc	20231117-1	20231228-1
iproute2	6.6.0-2	6.7.0-1
iputils	20231222-2	20240117-1
libelf	0.190-1	0.190-2
libffi	3.4.4-1	3.4.6-1
libgpg-error	1.47-1	1.48-1
libidn2	2.3.4-3	2.3.7-1
libnghttp2	1.58.0-1	1.59.0-2
libnghttp3	---	1.2.0-1
libseccomp	2.5.5-1	2.5.5-2
libsecret	0.21.2-1	0.21.4-1
libsysprof-capture	45.1-1	45.2-1
libtool	2.4.7+4+g1ec8fa28-6	2.4.7+4+g1ec8fa28-7
libusb	1.0.26-2	1.0.27-1
libxml2	2.12.3-1	2.12.5-1
licenses	20231215-1	20240206-1
linux-api-headers	6.4-1	6.7-1
lz4	1:1.9.4-1	1:1.9.4-2
mpfr	4.2.1-1	4.2.1-2
openssl	3.2.0-1	3.2.1-1
pacman	6.0.2-8	6.0.2-9
pam	1.5.3-3	1.6.0-4
perl	5.38.1-1	5.38.2-1
readline	8.2.007-1	8.2.010-1
shadow	4.14.2-1	4.14.5-1
sqlite	3.44.2-2	3.45.1-1
sudo	1.9.15.p4-1	1.9.15.p5-1
systemd	255.2-1	255.3-1
systemd-libs	255.2-1	255.3-1
systemd-sysvcompat	255.2-1	255.3-1
tzdata	2023d-1	2024a-1
xz	5.4.5-1	5.4.6-1
zlib	1:1.3-2	1:1.3.1-1

What should I be looking at and for here? Some notable update entries might be:

• fakeroot
• devicemapper
• acl

In some workflows I have, which build packages from source within the Arch container, there are not just warnings but build-breaking errors (I think bsdtar returns an error while extracting). I haven't made a standalone script reproducer for that yet, but here's a workflow which exhibits the problem.

Thanks for any insight!

[rhatdan]

What platform are you doing this on? Is user namespace setup correctly?

[AndydeCleyre]

Sorry, do you mean something other this?:

This can be reproduced for me locally on Ubuntu 22.04, as well as the corresponding GitHub Actions runner, with buildah 1.23.1.

Locally and in GHA, the configuration had been working for many months, but I haven't touched it in a while. Locally at least I have:

/etc/subuid:

andy:100000:65536

/etc/subgid:

andy:100000:65536

I haven't done a similar setup on GHA, where I'm counting on the included buildah package to be configured for immediate use.

[AndydeCleyre]

Is there any other information I can add that might clarify the problem?

[AndydeCleyre]

I'm moving past this by removing buildah from the process entirely and just using GHA containers instead.