[PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[Patrick Steinhardt]

Ubuntu 25.10 has been released. One prominent change in this version of
Ubuntu is the switch to some Rust-based utilities. Part of this switch
is also that Ubuntu now defaults to sudo-rs(1).

Unfortunately, this breaks our CI because sudo-rs(1) does not support
the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
implementation to fix this.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
---
Hi,

this breaks a bunch of our CI jobs, both for GitHub and GitLab. It would
probably make sense to fast-track the fix.

Thanks!

Patrick
---
 ci/install-dependencies.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/ci/install-dependencies.sh b/ci/install-dependencies.sh
index 0d3aa496fc..a8dcd9b9bc 100755
--- a/ci/install-dependencies.sh
+++ b/ci/install-dependencies.sh
@@ -65,6 +65,15 @@ ubuntu-*|i386/ubuntu-*|debian-*)
 		libsecret-1-dev libpcre2-dev meson ninja-build pkg-config cargo \
 		${CC_PACKAGE:-${CC:-gcc}} $PYTHON_PACKAGE
 
+	# Starting with Ubuntu 25.10, sudo can now be provided via either
+	# sudo(1) or sudo-rs(1), with the latter being the default. The problem
+	# is that it does not support `--preserve-env` though, which we rely on
+	# in our CI. We thus revert back to the C implementation.
+	if test -f /etc/alternatives/sudo
+	then
+		sudo update-alternatives --set sudo /usr/bin/sudo.ws
+	fi
+
 	case "$distro" in
 	ubuntu-*)
 		mkdir --parents "$CUSTOM_PATH"

---
base-commit: 60f3f52f17cceefa5299709b189ce6fe2d181e7b
change-id: 20251010-b4-pks-ci-ubuntu-sudo-rs-8e992b87ddf0

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[Junio C Hamano]

Patrick Steinhardt <ps@pks.im> writes:

> Ubuntu 25.10 has been released. One prominent change in this version of
> Ubuntu is the switch to some Rust-based utilities. Part of this switch
> is also that Ubuntu now defaults to sudo-rs(1).
>
> Unfortunately, this breaks our CI because sudo-rs(1) does not support
> the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
> implementation to fix this.
>
> Signed-off-by: Patrick Steinhardt <ps@pks.im>
> ---
> Hi,
>
> this breaks a bunch of our CI jobs, both for GitHub and GitLab. It would
> probably make sense to fast-track the fix.

It is curious why this is done outside Ubuntu.  The context is that
the outermost case "$distro" has this arm

    ubuntu-*|i386/ubuntu-*|debian-*)

which is where the patched code appears.

> @@ -65,6 +65,15 @@ ubuntu-*|i386/ubuntu-*|debian-*)
>  		libsecret-1-dev libpcre2-dev meson ninja-build pkg-config cargo \
>  		${CC_PACKAGE:-${CC:-gcc}} $PYTHON_PACKAGE
>  
> +	# Starting with Ubuntu 25.10, sudo can now be provided via either
> +	# sudo(1) or sudo-rs(1), with the latter being the default. The problem
> +	# is that it does not support `--preserve-env` though, which we rely on
> +	# in our CI. We thus revert back to the C implementation.
> +	if test -f /etc/alternatives/sudo
> +	then
> +		sudo update-alternatives --set sudo /usr/bin/sudo.ws
> +	fi

So at least shouldn't we be limiting ourselves to do this only when
/usr/bin/sudo.ws exists?  Or do it in the nested case "$distro" that
immediately follows this one to limit the effect only to Ubuntu
(which may need to make this into a helper function that is called
for both ubuntu-* and i386/ubuntu-* arms)?

>  	case "$distro" in
>  	ubuntu-*)
>  		mkdir --parents "$CUSTOM_PATH"

Thanks.

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[brian m. carlson]

[-- Attachment #1: Type: text/plain, Size: 702 bytes --]

On 2025-10-10 at 09:41:14, Patrick Steinhardt wrote:
> Ubuntu 25.10 has been released. One prominent change in this version of
> Ubuntu is the switch to some Rust-based utilities. Part of this switch
> is also that Ubuntu now defaults to sudo-rs(1).
> 
> Unfortunately, this breaks our CI because sudo-rs(1) does not support
> the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
> implementation to fix this.

I've requested that functionality (which I also use in a variety of
cases) upstream:
https://github.com/trifectatechfoundation/sudo-rs/issues/1299.
Hopefully it can be implemented in time for Ubuntu 26.04.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 262 bytes --]

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[Patrick Steinhardt]

On Fri, Oct 10, 2025 at 09:44:44AM -0700, Junio C Hamano wrote:
> Patrick Steinhardt <ps@pks.im> writes:
> > @@ -65,6 +65,15 @@ ubuntu-*|i386/ubuntu-*|debian-*)
> >  		libsecret-1-dev libpcre2-dev meson ninja-build pkg-config cargo \
> >  		${CC_PACKAGE:-${CC:-gcc}} $PYTHON_PACKAGE
> >  
> > +	# Starting with Ubuntu 25.10, sudo can now be provided via either
> > +	# sudo(1) or sudo-rs(1), with the latter being the default. The problem
> > +	# is that it does not support `--preserve-env` though, which we rely on
> > +	# in our CI. We thus revert back to the C implementation.
> > +	if test -f /etc/alternatives/sudo
> > +	then
> > +		sudo update-alternatives --set sudo /usr/bin/sudo.ws
> > +	fi
> 
> So at least shouldn't we be limiting ourselves to do this only when
> /usr/bin/sudo.ws exists?  Or do it in the nested case "$distro" that
> immediately follows this one to limit the effect only to Ubuntu
> (which may need to make this into a helper function that is called
> for both ubuntu-* and i386/ubuntu-* arms)?

No other distro has this sudo.ws / sudo-rs split at the current point in
time, and because of this they don't have /etc/alternatives/sudo,
either. So for now at least the condition should be sufficient, I think.

If we want to tighten this we could probably make this something like
"if test -f /etc/alternatives/sudo && test -f /usr/bin/sudo.ws". But to
be honest, I feel like all variants are somewhat brittle here and
there's scenarios where all of them will fail with upstream changes. So
I feel like the current version is good enough, but I'm happy to adjust
if you continue to feel otherwise.

Also, we don't have to do this for i386/ubuntu. Ubuntu has dropped 32
bit support, so it won't ever adopt this split. I have a patch series
pending that'll convert this CI job to instead use i386/debian, which
still continues to maintain 32 bit.

Thanks!

Patrick

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[Patrick Steinhardt]

On Fri, Oct 10, 2025 at 09:33:00PM +0000, brian m. carlson wrote:
> On 2025-10-10 at 09:41:14, Patrick Steinhardt wrote:
> > Ubuntu 25.10 has been released. One prominent change in this version of
> > Ubuntu is the switch to some Rust-based utilities. Part of this switch
> > is also that Ubuntu now defaults to sudo-rs(1).
> > 
> > Unfortunately, this breaks our CI because sudo-rs(1) does not support
> > the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
> > implementation to fix this.
> 
> I've requested that functionality (which I also use in a variety of
> cases) upstream:
> https://github.com/trifectatechfoundation/sudo-rs/issues/1299.
> Hopefully it can be implemented in time for Ubuntu 26.04.

Awesome, thanks!

Patrick

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

[Junio C Hamano]

Patrick Steinhardt <ps@pks.im> writes:

> On Fri, Oct 10, 2025 at 09:33:00PM +0000, brian m. carlson wrote:
>> On 2025-10-10 at 09:41:14, Patrick Steinhardt wrote:
>> > Ubuntu 25.10 has been released. One prominent change in this version of
>> > Ubuntu is the switch to some Rust-based utilities. Part of this switch
>> > is also that Ubuntu now defaults to sudo-rs(1).
>> > 
>> > Unfortunately, this breaks our CI because sudo-rs(1) does not support
>> > the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
>> > implementation to fix this.
>> 
>> I've requested that functionality (which I also use in a variety of
>> cases) upstream:
>> https://github.com/trifectatechfoundation/sudo-rs/issues/1299.
>> Hopefully it can be implemented in time for Ubuntu 26.04.
>
> Awesome, thanks!

Yeah, solving the problem at its root instead of having to work
around is a good thing to do.

Thanks.