dpkg: add setup-hook for unpacking .deb files

pkgs/servers/jibri/default.nix

@@ -21,7 +21,6 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
   nativeBuildInputs = [ dpkg makeWrapper ];
-  unpackCmd = "dpkg-deb -x $src debcontents";
 
   installPhase = ''
     runHook preInstall

pkgs/tools/package-management/dpkg/default.nix

@@ -71,6 +71,8 @@ stdenv.mkDerivation rec {
       cp -r scripts/t/origins $out/etc/dpkg
     '';
 
+  setupHook = ./setup-hook.sh;
+
   meta = with lib; {
     description = "The Debian package manager";
     homepage = "https://wiki.debian.org/Teams/Dpkg";

pkgs/tools/package-management/dpkg/setup-hook.sh

@@ -0,0 +1,12 @@
+unpackCmdHooks+=(_tryDpkgDeb)
+_tryDpkgDeb() {
+    if ! [[ "$curSrc" =~ \.deb$ ]]; then return 1; fi
+    # Don't use dpkg-deb -x as that will error if the archive contains a file
+    # or directory with a setuid bit in its permissions. This is because dpkg
+    # calls tar internally with the -p flag, preserving file permissions.
+    #
+    # We instead only use dpkg-deb to extract the tarfile containing the files
+    # we want from the .deb, then finish extracting with tar directly.
+    mkdir root
+    dpkg-deb --fsys-tarfile "$curSrc" | tar --extract --directory=root
+}