tar without preserving user [duplicate]

Question

I'd like to compress some files for http distribution, but found that .tar.gz keeps the user name and user ID and there doesn't seem to be any way to not do that? (There is a --numeric-owner option for tar which seems to ignore the user name, but still keeps the user ID.)

Doesn't that mean that .tar.gz is a poor choice for file distribution as my system probably is the only one with my user ID and my user name? Is .7z a better format for file distribution, or do you have any other recommendation?

Answer 1

Generally .tar.gz is a usable file distribution format. GNU tar allows you to replace owner, group and permissions with other values when adding files to the archive.

$ tar -c -f archive.tar --owner=0 --group=0 .

https://www.gnu.org/software/tar/manual/html_section/tar_33.html#SEC69

If your version of tar does not support the GNU options you can copy your source files to another directory tree and update group and ownership there, prior to creating your tar.gz file for distribution.

Answer 2

With GNU you can use --numeric-owner to prevent tar from storing your username. Alternatively, you can set another userid with --owner=ID. When it's extracted, those user ids will be dropped, unless the extractor is the root user.

A common way used to bundle files is cpio which is typically used with the --no-preserve-owner option. This is how rpm files are built.

But tar with user-ids is rarely an issue. If you want to be paranoid, you use a dedicated account for the final bundling.

Answer 3

You're looking for something like tar --owner=0 --group=0 to set everything owned by root/root.

Answer 4

You can fool tar into treating the files as if they have a different owner with fakeroot.

Fakeroot runs a command in an environment were it appears to have root privileges for file manipulation, by setting LD_PRELOAD to a library with alternative versions of getuid(), stat(), etc. This is useful for allowing users to create archives (tar, ar, .deb .rpm etc.) with files in them with root permissions/ownership.

Initially, all files will appear to be owned by root, but you can chown them from inside the fakeroot shell, and subsequent commands will see the new owner.

Answer 5

Any existing tarballs can be sanitized via something like:

#!/usr/bin/env perl
use strict;
use warnings;
use Archive::Tar 1.80;

for my $tarfile (@ARGV) {
    my $tar = Archive::Tar->new($tarfile) // die "failed to read '$tarfile'\n";
    for my $archivefile ($tar->list_files) {
        $tar->chown($archivefile, 'root:root');
    }
    my @compression;
    if ($tarfile =~ m/gz$/) {
        @compression = COMPRESS_GZIP;
    } elsif ($tarfile =~ m/bz$/) {
        @compression = COMPRESS_BZIP;
    }
    $tar->write($tarfile, @compression);
}