ngclient: Fix symlink usage on Windows - #2981
Conversation
Running ngclient on Windows (I believe NTFS only) leads to OSError: [WinError 1314] A required privilege is not held by the client symlinking is apparently a high privilege operation: let's add a fallback. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
79ab351 to
29a7c5b
Compare
| os.symlink(current, linkname) | ||
| try: | ||
| os.symlink(current, linkname) | ||
| except OSError: |
There was a problem hiding this comment.
Kind of... but I don't actually have a Windows/NTFS machine to test the more complicated code that would check for specific error codes, and the workaround should be harmless even if it happens for other reasons: just an extra copy of root.json
|
Tested on Windows (Python 3.13.12, NTFS) without Developer Mode: With shutil.copyfile fallback: 196/198 tests pass but test_intermediate_root_cache and test_load_metadata_from_cache fail due to unexpected extra root.json 'wb' writes that the test mocks catch. Replacing shutil.copyfile with os.link fixes both issues — all 198 tests pass without Developer Mode and no test changes needed. |
Thanks, this is much appreciated -- figuring this out without the system in question is painful. |
* using shutil.copyfile works but tests that mock os.open start misbehaving (only on NTFS, so we don't see this on CI) * shutil.copyfile is also not atomic (something we strive for in write ops) but os.link is Use os.link() in the workaround, it seems better all around. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
|
Switched NTFS workaround to
|
|
AI tells me we could actually test this in GH actions. I'll mark this draft while I look into it |
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Only handle the "required privilege is not held by client" error, not other OSErrors Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
|
GitHub workflow now runs tests on an unprivileged account on Windows:
|
| try: | ||
| os.symlink(current, linkname) | ||
| except OSError as e: | ||
| if getattr(e, "winerror", None) == 1314: |
3 participants
Running ngclient on Windows (I believe NTFS only, non-privileged account only) leads to
OSError: [WinError 1314] A required privilege is not held by the client
symlinking is apparently a high privilege operation: let's add a fallback, a real file will work just as well.
Fixes #2980
PR is partially AI generated