https://github.com/python/cpython/commit/7b1bc410015f1a8dc31fc707e324c44708d14c7f
commit: 7b1bc410015f1a8dc31fc707e324c44708d14c7f
branch: main
author: Sendao Yan <[email protected]>
committer: itamaro <[email protected]>
date: 2026-11-09T07:50:21-08:00
summary:
gh-159452: Run the regen-configure container as the invoking user (#159454)
`Tools/build/regen-configure.sh` ran the Autoconf container as root, so
with a rootful Docker daemon the regenerated files and `autom4te.cache`
ended up owned by root. The stale cache broke subsequent runs and
couldn't be removed without sudo.
Run the container as the invoking user instead: `--userns=keep-id` for
Podman, `-u UID:GID` for rootful Docker. Rootless runtimes already map
container root to the invoking user and need nothing. Also remove
`autom4te.cache` before and after the run, using the same image, so an
existing root-owned cache gets cleaned up too.
files:
A Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst
M Tools/build/regen-configure.sh
diff --git
a/Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst
b/Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst
new file mode 100644
index 000000000000000..531239d3e33f4a4
--- /dev/null
+++ b/Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst
@@ -0,0 +1,2 @@
+``Tools/build/regen-configure.sh`` no longer leaves
+root-owned files in the source tree.
diff --git a/Tools/build/regen-configure.sh b/Tools/build/regen-configure.sh
index c7683eb36763aff..a7a95b7878dc79a 100755
--- a/Tools/build/regen-configure.sh
+++ b/Tools/build/regen-configure.sh
@@ -26,4 +26,27 @@ if command -v selinuxenabled >/dev/null && selinuxenabled;
then
PATH_OPT=":Z"
fi
-"$RUNTIME" run --rm -v "$abs_srcdir:$WORK_DIR$PATH_OPT" "$IMAGE"
+# Run the container as the invoking user so that generated files are owned by
+# that user and not by root. Rootless runtimes already map root to the invoking
+# user, so a user mapping is only needed for rootful Docker.
+USER_OPT=""
+case "$RUNTIME" in
+ podman)
+ USER_OPT="--userns=keep-id"
+ ;;
+ docker)
+ if ! docker info --format '{{.SecurityOptions}}' | grep -q rootless;
then
+ USER_OPT="-u $(id -u):$(id -g)"
+ fi
+ ;;
+esac
+
+purge_autom4te_cache() {
+ [ -d "$abs_srcdir/autom4te.cache" ] || return 0
+ "$RUNTIME" run --rm -v "$abs_srcdir:$WORK_DIR$PATH_OPT" \
+ "$IMAGE" sh -c "rm -rf $WORK_DIR/autom4te.cache"
+}
+
+purge_autom4te_cache
+trap 'purge_autom4te_cache || true' EXIT
+"$RUNTIME" run --rm $USER_OPT -v "$abs_srcdir:$WORK_DIR$PATH_OPT" "$IMAGE"
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
