From 2928b4cbd2ac84132b28fb71a7aa74c6e0ef9f1a Mon Sep 17 00:00:00 2001 From: Steve Purcell Date: Mon, 5 Oct 2026 14:36:27 +0100 Subject: [PATCH] Skip TestExtractAndReplacePreservesSpecialModeBits when setgid is not permitted In certain build environments, e.g. sandboxed Nix, the build process is not allowed to set security-sensitive flags on files. When this is the case, we should skip the above test rather than fail. --- internal/update/extract_test.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/internal/update/extract_test.go b/internal/update/extract_test.go index a4259335..e5a576de 100644 --- a/internal/update/extract_test.go +++ b/internal/update/extract_test.go @@ -4,6 +4,7 @@ import ( "archive/tar" "archive/zip" "compress/gzip" + "errors" "os" "path/filepath" goruntime "runtime" @@ -331,7 +332,12 @@ func TestExtractAndReplacePreservesSpecialModeBits(t *testing.T) { t.Skip("no Unix mode bits on Windows") } _, exePath := newInstallDir(t, map[string]string{lstkBinaryName(): "old lstk"}) - require.NoError(t, os.Chmod(exePath, 0o755|os.ModeSetgid)) + if err := os.Chmod(exePath, 0o755|os.ModeSetgid); errors.Is(err, os.ErrPermission) { + // e.g. a build sandbox where the process isn't in the file's group + t.Skipf("not permitted to set setgid: %v", err) + } else { + require.NoError(t, err) + } if info, err := os.Stat(exePath); err != nil || info.Mode()&os.ModeSetgid == 0 { t.Skip("filesystem does not support setgid on files") }