fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rickeylev merged 2 commits into from
Apr 5, 2025
Merged

fix: treat ignore_root_user_error either ignored or warning #2739

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6dcef51
fix: treat ignore_root_user_error either ignored or warning
mattem Apr 5, 2025
1b1a211
Merge branch 'main' into fix/ignore_root_warning
rickeylev Apr 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
reached EOL. If users still need other versions of the `3.8` interpreter, please supply
the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
flipped back to ignoring the issue, and will only emit a warning when the attribute is set
`False`.
* (pypi) The PyPI extension will no longer write the lock file entries as the
extension has been marked reproducible.
Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down
4 changes: 2 additions & 2 deletions python/private/python.bzl
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting

@mattemmattemApr 5, 2025

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.

Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).

@rickeylevrickeylevApr 5, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?

The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.

I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.

@mattemmattemApr 5, 2025

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam

That's excellent to hear, and was the motivation for this diff.
We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)

this to `False`.
""",
mandatory = False,
),
Expand Down
40 changes: 21 additions & 19 deletions python/private/python_repository.bzl
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
logger = logger,
)

fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
exec_result = repo_utils.execute_unchecked(
rctx,
op = "python_repository.TestReadOnly",
arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
logger = logger,
)

# The issue with running as root is the installation is no longer
# read-only, so the problems due to pyc can resurface.
if exec_result.return_code == 0:
stdout = repo_utils.execute_checked_stdout(
# If the user is not ignoring the warnings, then proceed to run a check,
# otherwise these steps can be skipped, as they both result in some warning.
if not rctx.attr.ignore_root_user_error:
exec_result = repo_utils.execute_unchecked(
rctx,
op = "python_repository.GetUserId",
arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
op = "python_repository.TestReadOnly",
arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
logger = logger,
)
uid = int(stdout.strip())
if uid == 0:
fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
else:
fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

# The issue with running as root is the installation is no longer
# read-only, so the problems due to pyc can resurface.
if exec_result.return_code == 0:
stdout = repo_utils.execute_checked_stdout(
rctx,
op = "python_repository.GetUserId",
arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
logger = logger,
)
uid = int(stdout.strip())
if uid == 0:
logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
else:
logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix: treat ignore_root_user_error either ignored or warning#2739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

rickeylev
merged 2 commits into

from

Apr 5, 2025
 Merged


fix: treat ignore_root_user_error either ignored or warning
#2739
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
6dcef51

fix: treat ignore_root_user_error either ignored or warning


mattem Apr 5, 2025
1b1a211

Merge branch 'main' into fix/ignore_root_warning


rickeylev Apr 5, 2025

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


4 changes: 4 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,6 +69,10 @@ Unreleased changes template.
* (toolchains) Remove all but `3.8.20` versions of the Python `3.8` interpreter who has
 reached EOL. If users still need other versions of the `3.8` interpreter, please supply
 the URLs manually {bzl:obj}`python.toolchain` or {bzl:obj}`python_register_toolchains` calls.
* (toolchains) Previously [#2636](https://github.com/bazel-contrib/rules_python/pull/2636)
 changed the semantics of `ignore_root_user_error` from "ignore" to "warning". This is now
 flipped back to ignoring the issue, and will only emit a warning when the attribute is set
 `False`. 
* (pypi) The PyPI extension will no longer write the lock file entries as the
 extension has been marked reproducible.
 Fixes [#2434](https://github.com/bazel-contrib/rules_python/issues/2434).
Expand Down

4 changes: 2 additions & 2 deletions
python/private/python.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -803,8 +803,8 @@ to spurious cache misses or build failures).
However, if the user is running Bazel as root, this read-onlyness is not
respected. Bazel will print a warning message when it detects that the runtime
installation is writable despite being made read only (i.e. it's running with
root access). If this attribute is set to `False`, Bazel will make it a hard
error to run with root access instead.
root access) while this attribute is set `False`, however this messaging can be ignored by setting
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps this should be flipped back to False, so the user gets the warning (like they do now with the default), and True is then a true ignore.
Another option would be to make this a tri-state in a non-breaking way, or perhaps add yet another attribute (likely not preferable).
@rickeylevrickeylevApr 5, 2025

Copy link


Copy Markdown

Collaborator
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can have it print a warning if the root module is what configured the toolchain?
The situation I want to avoid is warning spam -- if a downstream user is running as root (for whatever reason), and happens to depend on rules_python (unbeknowst to them, and out of their control), getting warning spam is somewhat annoying.
I do wish we understood the cause here better. I'm mostly sure that the various glob-excludes have fixed this. And there's always the alternative to generate hash-based pyc files at repo-time (when possible) to help avoid the issue further.
@mattemmattemApr 5, 2025

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The situation I want to avoid is warning spam
That's excellent to hear, and was the motivation for this diff.

We have quite a number of toolchains registered (arguably too many), and received a lot of warnings (we actually fail builds if too many new log lines are introduced). The change in semantics in #2636 made it hard to remove the warnings, which led to me patching the logger and disabling warnings (now upstreamed as #2737)
this to `False`.
""",
 mandatory = False,
 ),
Expand Down

40 changes: 21 additions & 19 deletions
python/private/python_repository.bzl

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -137,28 +137,30 @@ def _python_repository_impl(rctx):
 logger = logger,
 )

 fail_or_warn = logger.warn if rctx.attr.ignore_root_user_error else logger.fail
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 # If the user is not ignoring the warnings, then proceed to run a check,
 # otherwise these steps can be skipped, as they both result in some warning.
 if not rctx.attr.ignore_root_user_error:
 exec_result = repo_utils.execute_unchecked(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 op = "python_repository.TestReadOnly",
 arguments = [repo_utils.which_checked(rctx, "touch"), "lib/.test"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 fail_or_warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 fail_or_warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 # The issue with running as root is the installation is no longer
 # read-only, so the problems due to pyc can resurface.
 if exec_result.return_code == 0:
 stdout = repo_utils.execute_checked_stdout(
 rctx,
 op = "python_repository.GetUserId",
 arguments = [repo_utils.which_checked(rctx, "id"), "-u"],
 logger = logger,
 )
 uid = int(stdout.strip())
 if uid == 0:
 logger.warn("The current user is root, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")
 else:
 logger.warn("The current user has CAP_DAC_OVERRIDE set, which can cause spurious cache misses or build failures with the hermetic Python interpreter. See https://github.com/bazel-contrib/rules_python/pull/713.")

 python_bin = "python.exe" if ("windows" in platform) else "bin/python3"

Expand Down