Skip to content

ngclient: Fix symlink usage on Windows - #2981

Open
jku wants to merge 1 commit into
theupdateframework:developfrom
jku:workaround-symlink-on-windows
Open

ngclient: Fix symlink usage on Windows#2981
jku wants to merge 1 commit into
theupdateframework:developfrom
jku:workaround-symlink-on-windows

Conversation

@jku

@jku jku commented Aug 7, 2026

Copy link
Copy Markdown
Member

Running ngclient on Windows (I believe NTFS only) leads to
OSError: [WinError 1314] A required privilege is not held by the client

symlinking is apparently a high privilege operation: let's add a fallback, a real file will work just as well.

Fixes #2980

PR is partially AI generated

@jku
jku requested a review from a team as a code owner August 7, 2026 08:03
Running ngclient on Windows (I believe NTFS only) leads to
  OSError: [WinError 1314] A required privilege is not held by the client

symlinking is apparently a high privilege operation: let's add a fallback.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku
jku force-pushed the workaround-symlink-on-windows branch from 79ab351 to 29a7c5b Compare August 7, 2026 08:08

@lukpueh lukpueh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix!

Comment thread tuf/ngclient/updater.py
os.symlink(current, linkname)
try:
os.symlink(current, linkname)
except OSError:

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this not too broad?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kind of... but I don't actually have a Windows/NTFS machine to test the more complicated code that would check for specific error codes, and the workaround should be harmless even if it happens for other reasons: just an extra copy of root.json

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works for me.

@Phantom9869

Phantom9869 commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Tested on Windows (Python 3.13.12, NTFS) without Developer Mode:

With shutil.copyfile fallback: 196/198 tests pass but test_intermediate_root_cache and test_load_metadata_from_cache fail due to unexpected extra root.json 'wb' writes that the test mocks catch.

Replacing shutil.copyfile with os.link fixes both issues — all 198 tests pass without Developer Mode and no test changes needed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

symlinks only work on windows/ntfs with elevated permissions

3 participants