Repository navigation
build(release): repack the Linux tarball with root ownership - #1003
Open
viwe-monai wants to merge 2 commits into
Open
viwe-monai wants to merge 2 commits into
viwe-monai wants to merge 2 commits into
Conversation
The Electrobun packaging stamps the CI runner's UID/GID on the archive's './' entry, so extracting thinkrail-desktop-linux-x64.tar.gz as root applies that ownership to the extraction directory itself — downloading and unpacking in $HOME, the normal place, ends up owned by a UID that does not exist on the target host and breaks SSH key login (JetBrains#1002). Repack the Linux first-install archive with --owner=0 --group=0 --numeric-owner so extraction leaves the destination directory alone. Fixes JetBrains#1002
viwe-monai
requested review from
Olga Lavrichenko (OLavrik),
Rustam Sadykov (SBOne-Kenobi),
danyaberezun and
Rinat S (rsolmano)
as code owners
October 29, 2026 06:05
![jetbrains-air[bot]](https://avatars.githubusercontent.com/in/3314082?s=60&v=4){kind=small}
The release job now repacks the Linux first-install tarball with root ownership (fix JetBrains#1002); updater archives are still passed through with their bytes untouched. Update the handoff contract accordingly.
| # directory itself (breaking $HOME permissions for SSH key login, | ||
| # #1002). Repack with root ownership so extracting is inert. | ||
| stage=$(mktemp -d) | ||
| tar -xzf "$path" -C "$stage" |
Contributor
There was a problem hiding this comment.
Blocking:
Problem: The new extraction step breaks the existing release-collector fixtures, which contain plain text at the Linux tarball paths. tar -xzf exits 2 in all four Linux collection tests.
Failure scenario: The release-artifact suite now gets 21 passes and four failures (stable/nightly × x64/ARM64), versus 25 passes on the base. The required Unit Tests job runs this suite through bun run test, so the aggregate “CI passed” gate cannot succeed.
Suggested fix: Create real Linux setup tarballs in the fixtures and check their extracted contents instead of the previous text-sentinel equality; retain the updater byte-preservation checks.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1002
Problem
thinkrail-desktop-linux-x64.tar.gzkeeps the CI runner's UID/GID (1001:1001) on the archive's./entry. When the tarball is extracted as root —cd ~/andtar -zxvf …, the normal flow from the README — GNU tar applies that ownership to the extraction directory itself:$HOME(or wherever it was unpacked) ends up owned by a UID that doesn't exist on the target host, which breaks SSH key login and any tool that checks home-directory permissions.Fix
In
build-binary/action.yml, after the Linux first-install artifact is staged (resolve-desktop), repack it with--owner=0 --group=0 --numeric-ownerso every entry — including./— is root-owned and extracting is inert. Only thebun-linux-*targets are touched; the macOS.dmgand Windows.zippaths are unchanged.The smoke step (
smoke:desktop:installer) still runs against the repacked archive afterwards, so the repacked bytes are what gets exercised.Verification
The repack idiom was exercised directly with GNU tar (including as an unprivileged user, since Actions runners are non-root —
tar --owner=0is honoured at create time):The workflow YAML parses cleanly and the edited
run:block passesbash -n.