Re: [OE-core] [PATCH] sstate.bbclass: apply proper umask when fetching from SSTATE_MIRROR

[Rasmus Villemoes <ravi@prevas.dk>]

On Sun, Jun 15 2025, "Richard Purdie via lists.openembedded.org" <richard.purdie=linuxfoundation.org@lists.openembedded.org> wrote:

> On Fri, 2025-06-06 at 11:39 +0200, Rasmus Villemoes wrote:
>> From: Rasmus Villemoes <ravi@prevas.dk>
>> 
>> Currently, files and directories created under ${SSTATE_DIR} when
>> fetching from an sstate mirror are not created with group write,
>> unlike when the sstate artifacts are generated locally. That's
>> inconsistent, and problematic when the local sstate dir is shared
>> among multiple users.
>> 
>> Wrap the fetching in a bb.utils.umask() context manager, and for simplicity
>> move the mkdir of SSTATE_DIR inside that.
>> 

> I appreciate this sounds crazy but this is causing some kind of
> regression being reported in our automated testing. Specifically,
> running:
>
> oe-selftest -r sstatetests.SStateCreation -j 1
>
> fails for me locally with this applied, as it does here in CI:
>
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/1767
>
> Worryingly, if I run:
>
> oeselftest -r sstatetests.SStateCreation.test_sstate_creation_distro_specific_pass -j 1
>
> i.e. a specific failing test, that fails even without the patch
> applied, and it shouldn't so there is something odd going on here even
> before the patch.
>
> We're going to have to get to the bottom of this before I can merge the
> patch.

Fair enough.

I'm not sure I can help much, but looking at that test code, something
feels a little fishy:

        # Now we'll walk the tree to check the mode and see if things are incorrect.
        badperms = []
        for root, dirs, files in os.walk(self.sstate_path):
            for directory in dirs:
                if (os.stat(os.path.join(root, directory)).st_mode & 0o777) != 0o775:
                    badperms.append(os.path.join(root, directory))

        # Return to original umask
        os.umask(orig_umask)

        if should_pass:
            self.assertTrue(badperms , msg="Found sstate directories with the wrong permissions: %s (found %s)" % (', '.join(map(str, targets)), str(badperms)))

So badperms is a list of stuff we've found that has ended up with wrong
permissions. But AFAICT, we assert that badperms is 'truish',
i.e. non-empty.

Just guessing: Perhaps the reason that passes on CI is exactly because
it always ends up getting the artifacts from an SSTATE_MIRROR (thus with
"wrong" permissions in the current state of the sstate mirror fetching),
while perhaps you don't when you run it locally, and thus you do see the
failure because your local dirs end up being created with the right 0775
perms, and badperms ends up empty?

While in there, the current_umask() helper seems redundant; just doing

  orig_umask = os.umask(0o022)

would do exactly what one wants.

Rasmus