https://github.com/python/cpython/commit/3830878f16b67476bb356f057308eb99e2e63d25 commit: 3830878f16b67476bb356f057308eb99e2e63d25 branch: 3.14 author: Miss Islington (bot) <[email protected]> committer: itamaro <[email protected]> date: 2026-11-09T16:14:48Z summary:
[3.14] gh-159452: Run the regen-configure container as the invoking user (GH-159454) (#161681) gh-159452: Run the regen-configure container as the invoking user (GH-159454) `Tools/build/regen-configure.sh` ran the Autoconf container as root, so with a rootful Docker daemon the regenerated files and `autom4te.cache` ended up owned by root. The stale cache broke subsequent runs and couldn't be removed without sudo. Run the container as the invoking user instead: `--userns=keep-id` for Podman, `-u UID:GID` for rootful Docker. Rootless runtimes already map container root to the invoking user and need nothing. Also remove `autom4te.cache` before and after the run, using the same image, so an existing root-owned cache gets cleaned up too. (cherry picked from commit 7b1bc410015f1a8dc31fc707e324c44708d14c7f) Co-authored-by: Sendao Yan <[email protected]> files: A Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst M Tools/build/regen-configure.sh diff --git a/Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst b/Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst new file mode 100644 index 000000000000000..531239d3e33f4a4 --- /dev/null +++ b/Misc/NEWS.d/next/Build/2026-10-15-17-19-41.gh-issue-159452.oJ1saO.rst @@ -0,0 +1,2 @@ +``Tools/build/regen-configure.sh`` no longer leaves +root-owned files in the source tree. diff --git a/Tools/build/regen-configure.sh b/Tools/build/regen-configure.sh index c7683eb36763aff..a7a95b7878dc79a 100755 --- a/Tools/build/regen-configure.sh +++ b/Tools/build/regen-configure.sh @@ -26,4 +26,27 @@ if command -v selinuxenabled >/dev/null && selinuxenabled; then PATH_OPT=":Z" fi -"$RUNTIME" run --rm -v "$abs_srcdir:$WORK_DIR$PATH_OPT" "$IMAGE" +# Run the container as the invoking user so that generated files are owned by +# that user and not by root. Rootless runtimes already map root to the invoking +# user, so a user mapping is only needed for rootful Docker. +USER_OPT="" +case "$RUNTIME" in + podman) + USER_OPT="--userns=keep-id" + ;; + docker) + if ! docker info --format '{{.SecurityOptions}}' | grep -q rootless; then + USER_OPT="-u $(id -u):$(id -g)" + fi + ;; +esac + +purge_autom4te_cache() { + [ -d "$abs_srcdir/autom4te.cache" ] || return 0 + "$RUNTIME" run --rm -v "$abs_srcdir:$WORK_DIR$PATH_OPT" \ + "$IMAGE" sh -c "rm -rf $WORK_DIR/autom4te.cache" +} + +purge_autom4te_cache +trap 'purge_autom4te_cache || true' EXIT +"$RUNTIME" run --rm $USER_OPT -v "$abs_srcdir:$WORK_DIR$PATH_OPT" "$IMAGE" _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
