After some searching, I found that most source packages (at least the ones that use autotools or cmake) allow installing to a different directory than PREFIX used for compiling, you just have to specify the desired location in the DESTDIR environment variable.
I ended up doing the following:
firejail --x11=none --net=none --whitelist="$PWD" # Enter sandbox
./configure # (or similar)
DESTDIR=dest make install # install application into dest
exit # from firejail
pkgname="$(basename "$PWD")" # (or specify desired package name manually)
fakeroot tar czf "$pkgname.tgz" -C dest . # pack the installed files into a .tgz archive
fakeroot alien --version=$(date +%F) -k "$pkgname.tgz" # create a .deb package from the .tgz archive
One can also use
sudo alien -i instead of
fakeroot alien in the last command to immediately install the package as well. Alternatively, if you don't want to turn the application into a package, you can replace the last line (which invokes
sudo tar xzf "$pkgname.tgz" -C / to extract the package as root.
A few things to note here:
- Instead of simply avoiding running potentially harmful commands as root, the compilation and installation happens inside a sandbox, which is even safer (but completely optional).
- I abandoned
checkinstall and use
alien instead, which is a slightly cleaner and safer solution as it does not depend on ugly and unreliable hacks for observing and reversing file operations.