nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-23 17:12:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

python313Packages.celery: skip tests that check group

Browse Source 
Fixes builds on NixOS 25.11/unstable on aarch64-linux
and x86_64-linux. Resolves #471417.

Celery attempts to prevent running as root when
the pickle format is enabled, as pickles allow
arbitrary code execution on load. If it cannot
get information about the current user or group,
it assumes that it is running as root.
This is expected behavior.

0527296acb/celery/platforms.py (L807-L814)

On some machines, it cannot obtain this information
in the build sandbox, and the build fails. The two
latest 25.11 tags fail to build on two of my machines
(25.11.20250627.30e2e28 aarch64-linux and
 25.11.20250627.30e2e28 x86_64-linux)
as well as my CI:

nix build nixpkgs/c8cfcd6#python313Packages.celery --rebuild
nix build nixpkgs/c6f52eb#python313Packages.celery --rebuild

A reasonable alternative would be to set
C_FORCE_ROOT in the check environment. I choose to
instead disable the failing tests based on precedent
(previous tests that fail similarly are disabled)
and to avoid complications if a test depends on the
absence of C_FORCE_ROOT now or in the future.

(cherry picked from commit efa95b1907)
This commit is contained in:
Tucker Shea
2025-12-22 10:16:03 -05:00
committed by github-actions[bot]
parent 273eff29c1
commit 5399a36cbc
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pkgs/development/python-modules/celery/default.nix
View File

@@ -118,6 +118,13 @@ buildPythonPackage rec {
"test_stamping_headers_in_options"
"test_stamping_with_replace"
# Celery tries to look up group ID (e.g. 30000)
# which does not reliably succeed in the sandbox on linux,
# so it throws a security error as if we were running as root.
# https://github.com/celery/celery/blob/0527296acb1f1790788301d4395ba6d5ce2a9704/celery/platforms.py#L807-L814
"test_regression_worker_startup_info"
"test_check_privileges"
# Flaky: Unclosed temporary file handle under heavy load (as in nixpkgs-review)
"test_check_privileges_without_c_force_root_and_no_group_entry"
]