Skip to content

fix(yocto): avoid preserving source groups during unpack - #1225

Merged
kvinwang merged 2 commits into
Dstack-TEE:nextfrom
WimYedema:fix/rsync-archive-group-next
Sep 16, 2026
Merged

kvinwang merged 2 commits into
Dstack-TEE:nextfrom
WimYedema:fix/rsync-archive-group-next

Conversation

@WimYedema

@WimYedema WimYedema commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

The dstack recipes copy source trees from outside BitBake's work directory. Archive-mode rsync attempts to preserve their group ownership, which can fail when the build user cannot assign the source group.

Disable group preservation while retaining the other archive-mode attributes.

WimYedema and others added 2 commits September 15, 2026 14:17
The dstack recipes copy source trees from outside BitBake's work directory. Archive-mode rsync attempts to preserve their group ownership, which can fail when the build user cannot assign the source group.\n\nDisable group preservation while retaining the other archive-mode attributes.
`--no-group` only covers the receiver-is-not-super-user path. When bitbake
runs as (fake) root -- rootless docker/podman, or `sudo os/build.sh` -- archive
mode still applies `-o`, and chown to an unmapped source uid fails the same
way:

    rsync: [receiver] chown ".../.f.txt.nQSbHp" failed: Invalid argument (22)
    rsync error: some files/attrs were not transferred (code 23)

The aborted transfer also leaves the file at the temp-file mode (0600) instead
of the source mode, so a partially-staged tree can fail later tasks.

Verified with rsync 3.2.7 across the three privilege setups (non-root without
the source group, non-root with an unmappable gid, userns-root with an
unmappable uid): only `--no-owner --no-group` succeeds in all three.
@kvinwang

kvinwang commented Sep 16, 2026

Copy link
Copy Markdown
Collaborator

Right fix, right scope — these two recipes are the only in-tree places staging a tree from outside WORKDIR, and both do_installs use explicit install -m, so dropping ownership on the staging copy can't reach the packaged image.

One gap, so I pushed a follow-up (fdfdfbd) instead of a round-trip: --no-group only helps while rsync believes it is not super-user. Under rootless docker/podman or sudo os/build.sh, archive mode still applies -o and fails the same way — chown ... Invalid argument (22), exit 23 — and the aborted transfer leaves the file at the temp-file mode (0600) rather than the source mode, so the staged tree goes silently wrong. Verified with rsync 3.2.7: only --no-owner --no-group survives all three privilege setups.

Ownership is meaningless for a WORKDIR staging copy, so the follow-up drops both and adds a short comment above each do_unpack recording why, otherwise this folds back into a bare -a at the next cleanup. -p is kept deliberately — executable bits still matter.

LGTM with that on top.

@kvinwang
kvinwang merged commit dcce1f6 into Dstack-TEE:next Sep 16, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants