Q:

Buildkit Issue - permissions?

I've encountered a problem (only recently) with buildkit, where when it comes time for me to run:
~/buildkit/bin/civibuild install "civi46" --url "http://civi46" --admin-pass "password" --web-root "/var/www/civi46"
I get
++ CMS_DB_HOSTPORT=127.0.0.1:3306
++ pushd /var/www/civi46
++ '[' -f sites/default/settings.php ']'
++ rm -f sites/default/settings.php
rm: cannot remove `sites/default/settings.php': Permission denied
But when I run 
sudo ~/buildkit/bin/civibuild install "civi46" --url "http://civi46" --admin-pass "password" --web-root "/var/www/civi46"
I get 
+ bower install -f
bower ESUDO         Cannot be run with sudo
Additional error details:
Since bower is a user command, there is no need to execute it with superuser permissions.
If you're having permission errors when using bower without sudo, please spend a few minutes learning more about how your system should work and make any necessary repairs.
http://www.joyent.com/blog/installing-node-and-npm
https://gist.github.com/isaacs/579814
You can however run a command with sudo using --allow-root option
This takes place even if I (shudder) set settings.php to have 777.
Even if I try to install civi manually after that, it is missing the files lang.php and civicrm-version.php. 
With these copied from elsewhere, and the correct install details, clicking install results in "cannot lock table civicrm_acl - doesn't exist". Of course it doesn't exist. I need you to create it, silly install.php!

A:

The civibuild command is designed to run as a regular shell user (e.g. john) -- without root permissions. The source code should all be owned by the shell-user, and the data files should be owned by a mix of www-data/apache/www/john. No files should should be owned by root.
The exact errors have varied (depending on the revision and the commands used), so I generally run a search to identify files with errant permissions, e.g.
## Searching for files owned by root (or not by john)
find ~/.npm/ ~/.composer/ ~/.drush/ ~/buildkit/ -user root
find ~/.npm/ ~/.composer/ ~/.drush/ ~/buildkit/ ! -user $(whoami)
find ~/.npm/ ~/.composer/ ~/.drush/ ~/buildkit/ ! -user john -a ! -user www-data

## Changing owner from root to john
find ~/.npm/ ~/.composer/ ~/.drush/ ~/buildkit/ -user root -exec chown john {} \;

Note that this search covers several folders, including:

The caches generated by various build tools (eg npm, composer, drush)
The caches generated by buildkit (eg ~/buildkit/app/tmp)
The actual build (eg ~/buildkit/build/mybuild)

Additionally, if I've recently run amp config to change the permission policy, fixing the permissions on existing files can be pretty fiddly. I find easiest to delete the old build (e.g. civibuild destroy mybuild or rm -rf ~/buildkit/build/mybuild) and then recreate it.

