New feature from PR #4181 causes "EPERM: operation not permitted, symlink" on Windows

[qiv-paul]

Describe the bug

The changes to link.ts introduced in #4181 render the CDK unusable on my Windows installation. This problem could affect many Windows users.

Windows blocks the creation of symlinks for non-administrative users by default.

Expected Behavior

The CDK should successfully complete common operations such as cdk ls.

Current Behavior

The CDK crashes with the following error message, caused by a default Windows policy that blocks the creation of symlinks for non-administrative users.

Jsii EPERM: operation not permitted, symlink 'C:\Users\<redacted>\AppData\Local\AWS\jsii\package-cache\@aws-cdk\asset-awscli-v1\2.2.200\e4e90fd04f7f09098dd1187a8bfa52039bf7ddcab92cd5932ded1f9786c4d28c' -> 'C:\Users\<redacted>\AppData\Local\Temp\jsii-kernel-45S6Uu\node_modules\@aws-cdk\asset-awscli-v1'
Error: EPERM: operation not permitted, symlink 'C:\Users\<redacted>\AppData\Local\AWS\jsii\package-cache\@aws-cdk\asset-awscli-v1\2.2.200\e4e90fd04f7f09098dd1187a8bfa52039bf7ddcab92cd5932ded1f9786c4d28c' -> 'C:\Users\<redacted>\AppData\Local\Temp\jsii-kernel-45S6Uu\node_modules\@aws-cdk\asset-awscli-v1'
    at symlinkSync (node:fs:1816:3)
    at link (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:10445:38)
    at extractViaCache (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:11493:29)
    at Object.extract (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:11450:81)
    at C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:9916:127
    at Kernel._Kernel_debugTime (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:10365:24)
    at Kernel._Kernel_load (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:9916:105)
    at C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:9653:181
    at Kernel._Kernel_debugTime (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:10365:24)
    at Kernel.load (C:\Users\<redacted>\AppData\Local\Temp\jsii-java-runtime1812729864297267298\lib\program.js:9653:96)

Reproduction Steps

1. Initialize a new sample app on Windows using the latest CDK and jsii: cdk init sample-app --language java
2. Execute maven package or cdk ls. Maven must be installed.

I suspect that other languages are affected as well, so you might be able to reproduce this with any other language.

Possible Solution

The Windows Developer Mode disables the policy and allows the creation of the symlinks: https://learn.microsoft.com/en-gb/windows/apps/get-started/enable-your-device-for-development

Developer mode disables several other safeguards and allows i.e. the installation of untrusted apps, so it should be avoided if not strictly needed.

There are a few potentially better options:

• Don't enable the symlink performance optimization for Windows by default.
• Use links of type junction instead of a directory symlink. Windows allows the creation of these by default, but there might be implications I don't know of.

Additional Information/Context

No response

SDK version used

versions that contain PR #4181, e.g. jsii 1.86.1

Environment details (OS name and version, etc.)

Windows 11 Pro 22621.1992

[jreijn]

I am having the same issue on Windows 11. I found a workaround for now in #4207 by setting the environment variable JSII_RUNTIME_PACKAGE_CACHE to "disabled".

You can test if that works by setting the variable in Powershell

$env:JSII_RUNTIME_PACKAGE_CACHE="disabled"

Afterwards you can set it as a user environment variable, so you don't have to set it all the time.

[alFReD-NSH]

Setting $env:JSII_RUNTIME_PACKAGE_CACHE="disabled" worked for me.

[v79]

I've also been affected by this, and setting JSII_RUNTIME_PACKAGE_CACHE="disabled" resolved the issue for me.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.