From 2000e2a59a012a52a471082944467d454090bbf1 Mon Sep 17 00:00:00 2001
From: Kemal Buyukkaya <kbuyukkaya@microsoft.com>
Date: Fri, 9 Oct 2026 13:15:37 +0000
Subject: [PATCH] build-pg-focal: build unprivileged so RUN_TESTS=1 can run
 initdb

The builder container runs as root, and dpkg-buildpackage ran as root too.
initdb refuses to run as root, so with RUN_TESTS=1 every major's
check-world bailed out at its first initdb ("initdb: error: cannot be run
as root"), failing the build before signing.

Keep root for apt / mk-build-deps, then hand the tree to an unprivileged
"builder" user and run dpkg-buildpackage through runuser; it gains root
via fakeroot only to assemble the .debs, as Debian intends. Do this with
or without tests so a tested build exercises the same path an untested
one ships.

Validated locally (podman, PG16, RUN_TESTS=1): check-world passes and the
produced package set is identical to the last CI build, with root:root
ownership inside the .debs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 scripts/build_pg_focal | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/scripts/build_pg_focal b/scripts/build_pg_focal
index dce3ae1d..04ae2892 100755
--- a/scripts/build_pg_focal
+++ b/scripts/build_pg_focal
@@ -237,9 +237,19 @@ mk-build-deps --install --remove \
   --tool 'apt-get -o Debug::pkgProblemResolver=yes --yes --no-install-recommends' \
   debian/control
 
-echo "==> [6/6] Build binary packages (DEB_BUILD_OPTIONS='${BUILD_OPTIONS}')"
+# Root is only needed for apt above. Build unprivileged (fakeroot handles
+# packaging), since initdb refuses to run as root and RUN_TESTS=1 needs it.
+BUILD_USER="${BUILD_USER:-builder}"
+as_build_user() { "$@"; }
+if [ "$(id -u)" = "0" ]; then
+  id -u "${BUILD_USER}" > /dev/null 2>&1 || useradd --create-home --shell /bin/bash "${BUILD_USER}"
+  chown -R "${BUILD_USER}:" "${WORK}"
+  as_build_user() { runuser -u "${BUILD_USER}" -- "$@"; }
+fi
+
+echo "==> [6/6] Build binary packages as $(as_build_user id -un) (DEB_BUILD_OPTIONS='${BUILD_OPTIONS}')"
 export DEB_BUILD_OPTIONS="${BUILD_OPTIONS}"
-dpkg-buildpackage -b -uc -us
+as_build_user dpkg-buildpackage -b -uc -us
 
 echo "==> Collect artifacts into ${OUTPUT_DIR}"
 cp -v "${WORK}"/*.deb "${OUTPUT_DIR}/"