#36615 guix: add --no-same-owner to codesign.sh TAR_OPTIONS

ReviewabilityReviewsAgreementSize
#36615 marcofleon guix: add --no-same-owner to codesign.sh TAR_OPTIONSReady0Positive0 + 1 tests
  • Prevent archive extraction failures when release signers run guix-codesign inside container environments
  • Ready to review, with nothing known that would invalidate a review
  • Concept approval without stated reasons (fanquake)
  • Suggests extracting the variable into a shared script to avoid repetition (willcl-ark)
  • 0 lines added or modified outside tests
  • 1 lines added or modified in tests
  • 1 lines removed in total
  • 1 files, 1 commits
Build and CI#15 of 56
P3 · bug fix
  • P3 because it fixes archive extraction failures for release signers running inside containers
  • The impact is confined to release codesigning scripts and does not alter reproducible build outputs
  • Ranking pass: Moved up from 40: blocks release codesigners running guix-codesign in containers, a concrete release-process failure rather than hygiene
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Adds `--no-same-owner` to `TAR_OPTIONS` in the Guix codesigning script (`codesign.sh`). This prevents `tar` from attempting to restore original file ownership when extracting codesigning archives.

Problem: Running `guix-codesign` as root inside container environments fails with `Cannot change ownership to uid 0, gid 0: Invalid argument` when unpacking codesigning tarballs, blocking signers using container images.

Evidence of importance:

  • PR description documents extraction failures on v32.0: `tar: ./detached-sig-create.sh: Cannot change ownership to uid 0, gid 0: Invalid argument ... tar: Exiting with failure status due to previous errors`
  • PR description notes that PR #34550 previously applied `--no-same-owner` to `build.sh` (now `setup.sh`) but omitted `codesign.sh`

Risk of a mistake: low (build). A bug would only affect release codesigning script execution during release preparation.

Changed since the previous assessment: None; the diff and commit remain identical.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

  • author: response to willcl-ark and fanquake regarding extracting TAR_OPTIONS into libexec/prelude.sh 2026-10-30

Agreement

Positive

support without stated reasons, no open objection (fanquake)

Thread notes: fanquake agreed with willcl-ark's suggestion to extract TAR_OPTIONS into libexec/prelude.sh; because agreeing with an item does not answer it on behalf of the author, the suggestion remains open.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
willcl-ark (member)suggestion, maintenanceextract TAR_OPTIONS into libexec/prelude.sh to avoid repeatsopenansweredno2026-10-26: 'Could that var be extracted into libexec/prelude.sh to avoid repeats?'

Support:

  • fanquake (member) (Concept ACK, 2026-10-23): (no reason given) [not substantive]

Participants:

  • fanquake (member, support, 2 statements 2026-10-23 to 2026-10-30): Concept ACK; agreed that TAR_OPTIONS could be extracted to prelude.sh
  • willcl-ark (member, neutral, 1 statements 2026-10-26 to 2026-10-26): suggested extracting TAR_OPTIONS into libexec/prelude.sh to avoid repeats

Files

2 lines under test/bench/ci.

  • contrib/guix/libexec/codesign.sh +1/-1

Card

The short text the ranking pass compares across PRs.

Adds `--no-same-owner` to `TAR_OPTIONS` in the Guix codesigning script. Running `guix-codesign` as root inside container environments causes `tar` to abort with ownership errors when unpacking codesigning archives. This mirrors a prior fix applied to Guix setup in PR #34550, enabling release signers to extract tarballs properly inside containers.

Data

dossier JSON · extract JSON · model ledger, generated 2026-10-31T01:17, confidence high, input hash 8b4647f0b67fb499
thread read through 2026-10-30 (4 statements), head d2e5108ea2
labels: Build system

Categories

Build and CI

P3 · bug fix (ranking pass: Moved up from 40: blocks release codesigners running guix-codesign in containers, a concrete release-process failure rather than hygiene)

Fixes a failure when running `guix-codesign` as root inside container environments (`Cannot change ownership to uid 0, gid 0: Invalid argument`). Resolves a container extraction issue for signers without affecting general reproducible build integrity.

Membership: Has Build system label and modifies `contrib/guix/libexec/codesign.sh`, which is part of the Guix release tooling.

Factors: security/stability 0, bug 1, performance 0, user value 1, leverage 0