privoxy: port activation fails due to existence of '${prefix}/etc/privoxy/CA/trustedCAs.pem'

[mascguy (Christopher Nielsen)]

With the latest update - including the new default variant user_pki_bundle - the following failure occurs during activation. It occurs regardless, even when no previous version is installed.

--->  Activating privoxy @3.0.33_2+https_inspection+user_pki_bundle
Error: Failed to activate privoxy: Image error: /opt/local/etc/privoxy/CA/trustedCAs.pem already exists and does not belong to a registered port. Unable to activate port privoxy. Use 'port -f activate privoxy' to force the activation.

Forcing the activation does succeed, albeit with the following warning:

--->  Activating privoxy @3.0.33_2+https_inspection+user_pki_bundle
Warning: File /opt/local/etc/privoxy/CA/trustedCAs.pem already exists. Moving to: /opt/local/etc/privoxy/CA/trustedCAs.pem.mp_1648320311.

This should be fixed, to eliminate the need to forcibly activate the port.

[mascguy (Christopher Nielsen)]

Of note, this is also occurring for buildbot builds. So it's definitely an issue.

​https://ports.macports.org/port/privoxy/builds/

[essandess (Steve Smith)]

Groan, sorry. I’ll post a fix. I think there are three related issues here:

1. This specific bug.
2. The tcl code that makes @mascguy’s brain hurt (mine too, evidently): ​https://github.com/macports/macports-ports/pull/14354#discussion_r835502075
3. The necessary depends_lib on curl-ca-bundle and apple-pki-bundle needed to update trustedCAs.pem whenever these ports are updated, but also unnecessarily rebuilds and installs the privoxy binary.

For 2: Chris, are you able to point to a cleaner tcl implementation of essentially file output operators like >>, but in tcl, not bash?

For 3: I think the cleanest approach is to add a subport that installs trustedCAs.pem, and move the depends_lib‘s to that subport.

Comments/feedback on any of this?

[essandess (Steve Smith)]

Please see: ​https://github.com/macports/macports-ports/pull/14386

Note: I don't believe that the new port privoxy-pki-bundle should be built by a buildbot and provided by MacPorts so that the CAs are guaranteed to be as recent as the latest ones provided by the dependent ports. How should this be reflected in the Portfile?

[essandess (Steve Smith)]

Also note: installing this updated port will also require a port -f activate privoxy for anyone who has a previously-installed CA file /opt/local/etc/privoxy/CA/trustedCAs.pem. I don't know any way to avoid this.

[essandess (Steve Smith)]

In 8662ecd1af7e9dc7947c583f85ad94880ea2b97b/macports-ports (master):

privoxy: Bugfix, add privoxy-pki-bundle subport that depends on other PKI bundles

• Fixes: #64892
• Submission of privoxy-pki-bundle

[jmroot (Joshua Root)]

Replying to essandess:

Also note: installing this updated port will also require a port -f activate privoxy for anyone who has a previously-installed CA file /opt/local/etc/privoxy/CA/trustedCAs.pem. I don't know any way to avoid this.

You could move it aside in pre-activate if that's always the right thing to do, or if not, detect the situation and print a more informative error message.

[cooljeanius (Eric Gallager)]

Replying to essandess:

3. The necessary depends_lib on curl-ca-bundle and apple-pki-bundle needed to update trustedCAs.pem whenever these ports are updated, but also unnecessarily rebuilds and installs the privoxy binary.

Reminder that people could be using certsync instead of curl-ca-bundle, so a path-style dependency should be used so either can satisfy it