Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

getfacl not found in v0.63.0? #2134

Closed
anh-rivergon opened this issue Sep 30, 2022 · 11 comments · Fixed by #2136
Closed

getfacl not found in v0.63.0? #2134

anh-rivergon opened this issue Sep 30, 2022 · 11 comments · Fixed by #2136

Comments

@anh-rivergon
Copy link

In v0.63.0 (could have been any release made on Sep-30), a new step "Backup artifact permissions" was added to the github workflow build.xml and triggered this error for us. Anyone else seeing the same issue -"getfack not found" ?

Run cd dist && getfacl -R . > permissions-backup.acl
cd dist && getfacl -R . > permissions-backup.acl
shell: sh -e {0}
env:
CI: true
/__w/_temp/92dd0f30-d46f-4688-a246-5dcbb7d5ac03.sh: 1: /__w/_temp/92dd0f30-d46f-4688-a246-5dcbb7d5ac03.sh: getfacl: not found
Error: Process completed with exit code 127.
@mrgrain
Copy link
Contributor

mrgrain commented Sep 30, 2022 •
edited

Yes that was released today. What os or image does your workflow run on?

@mrgrain
Copy link
Contributor

mrgrain commented Sep 30, 2022 •
edited

In hindsight we should have made this an opt-in step. Looking to do a fix asap, but I'm traveling tomorrow.

@mrgrain
Copy link
Contributor

mrgrain commented Sep 30, 2022

Cc @jmalins

@anh-rivergon
Copy link
Author

The release.xml says "runs-on: ubuntu-latest" -- I ran with "npx projen new awscdk-construct" went with the out of the box configuration.

@mrgrain
Copy link
Contributor

mrgrain commented Sep 30, 2022

Thanks for the info. That's certainly expected to work. 🤔

@jmalins
Copy link
Contributor

jmalins commented Oct 1, 2022 •
edited

It looks like the default configuration of the awscdk-construct runs using the jsii/superchain:1-buster-slim-node14 container image. We will need to add the acl package to the superchain image build in the JSII project. That should fix the default case.

That being said, you're right, there should also be an opt-out for the cases where users bring their own images.

@mrgrain I can submit a superchain PR this weekend, as that should be a one liner, but may not be able to get to a parameterized fix until Monday.

@jmalins jmalins mentioned this issue Oct 1, 2022
Merged
mergify bot pushed a commit to aws/jsii that referenced this issue Oct 1, 2022
@jmalins
feat(superchain): add 'acl' package to support projen GHA (#3783)
306b248 
Adds the `acl` package to the superchain image.

A recent [projen PR](projen/projen#2103) added a build-time dependency on the `getfacl` and `setfacl` tools in this package to workaround a bug in GitHub Actions. The package is included in the GHA `ubuntu-latest` image, but not superchain.

Should address: projen/projen#2134

---

By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license].

[Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0
@mrgrain
Copy link
Contributor

mrgrain commented Oct 1, 2022

Thanks @jmalins ✅

Or maybe we don't even need an opt out but just have the steps not failing the whole Pipeline (and display a warning of sorts). 🤔

@mrgrain mrgrain mentioned this issue Oct 1, 2022
Merged
@jmalins
Copy link
Contributor

jmalins commented Oct 1, 2022

@mrgrain I had the same thought overnight. If the backup/restore steps were to become no-ops when the getfacl / setfacl tools are missing, with a suitable warning to explain the situation, that could be ideal.

Having the tools in ubuntu-latest and jsii/superchain:* means the only exposure to the no-op/warning will be projects using custom containers. That shouldn't be many users and they should already be on high alert for tooling issues.

Plus, any opt-out prop would need to be drilled pretty deeply into the build and release packages. It also becomes vestigial API when GH gets their act together and fixes the underlying issue.

@mrgrain
Copy link
Contributor

mrgrain commented Oct 1, 2022

I have a PR ready (see link) for the non failure. Not sure if that's the best way to do it, but certainly the easiest.

@anh-rivergon
Copy link
Author

anh-rivergon commented Oct 1, 2022 •
edited

For now, this got me past it. Optional is a good idea though

workflowBootstrapSteps: [
{
name: 'Install acl #1',
run: 'sudo apt-get update -y',
},
{
name: 'Install acl #2',
run: 'sudo apt-get install -y acl',
}
]

pflorek added a commit to pepperize/cdk-apigateway-swagger-ui that referenced this issue Oct 2, 2022
@pflorek
fix: downgrade projen to 0.62.27
9bb9f99 
> `getfacl` not installed

projen/projen#2134
@mergify mergify bot closed this as completed in #2136 Oct 2, 2022
mergify bot pushed a commit that referenced this issue Oct 2, 2022
@mrgrain
fix: getfacl not found (#2136)
2202a34 
In #2132 we fixed an issue with file permissions not being preserved in GH Action workflows. The implementation uses the `acl` package to backup end restore permissions.  While we can ensure the package is installed in all default runners or containers, it might not be available in customized workflows.

This change marks the permissions backup and restore steps as allowed to fail. Since it is a workaround for GH Actions issue and only required in certain situations, we should not fail the whole build if the package is not available.

Fixes: #2134 

Additionally fixes an issue with invalid workflow files being generated when `continueOnError` is set on a Job Step.

---
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
@mrgrain
Copy link
Contributor

mrgrain commented Oct 2, 2022

I can confirm this is fixed now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: getfacl not found mrgrain/projen
3 participants
@mrgrain @jmalins @anh-rivergon