Repository navigation
build-rust: make rustup's install paths group-writable for crate-pinned toolchains - #140
Merged
Jonathan Gangi (JAVGan) merged 1 commit intoNov 10, 2026
Conversation
A crate can pin a toolchain via rust-toolchain.toml, which makes rustup install that toolchain at build time. Under OCP's arbitrary-UID/GID-0 model rustup cannot write to RUSTUP_HOME, so the build fails before cargo runs. This extends the existing cargo-cache treatment to the rustup paths an install touches: tmp, downloads, toolchains, update-hashes, and settings.toml. The chmod is non-recursive so already-installed toolchain binaries stay read-only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Collaborator
|
/ok-to-test |
Parthey Khanderia (pkhander)
approved these changes
Nov 10, 2026
Jonathan Gangi (JAVGan)
approved these changes
Nov 10, 2026
Jonathan Gangi (JAVGan)
merged commit Nov 10, 2026
2355ba9
into
konflux-lightwell:main
1 of 3 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Building a wheel whose dependency tree contains a Rust-backed build backend fails in
fromager-build-wheels:The trigger is a crate pinning a toolchain.
uv_build— the build backend forbidict,among others — ships a
rust-toolchain.tomlpinning1.97.1, while the image installs1.98.1via--default-toolchain "${RUST_VERSION}". rustup therefore tries to install thepinned toolchain at build time, which requires writing to
RUSTUP_HOME.build-rust.shalready makescargo/{registry,git}group-writable for the same OCParbitrary-UID/GID-0 reason, but nothing under
rustupis writable.Why not just
rustup/tmpMaking only
tmpwritable moves the failure rather than fixing it. Reproduced locally byreplicating the script's output (root-owned
RUSTUP_HOME, only cargo caches group-writable)and running as a non-root UID with GID 0:
could not create temp file .../rustup/tmp/...: Permission denied+ tmpcomponent download failed ... cleaning up cached downloads: No such file or directory+ downloads, toolchains, settings.toml, rustupcould not write update hash file: .../rustup/update-hashes/...+ update-hashesrustup run <ver> rustc --versionworksNote on the chmod
Non-recursive, unlike the cargo lines.
toolchains/only needs to be writable so a newtoolchain directory can be created;
-Rwould make every already-installed toolchain binarywritable, against the intent of the existing comment.
Testing
Verified in the reproduction above. Not covered by CI —
ci.ymldoesn't build the image, andnothing runs it as a non-root user, so this condition isn't observable in CI today.
🤖 Generated with Claude Code