SysAdmin 5bb24235bd fix(linux/build): tolerate find perm-denied in chroot scan (M1.1 iter24) ...

🎉 Run #4271's Build A actually produced the ISO. derivative-maker ran
clean for 15:24:

    INFO: Script ./derivative-maker completed.
          Exit Code: 0. Errors Detected: 0. Execution Time: 00:15:24
    '/home/user/derivative-binary/.../Kicksecure-CLI-18.1.7.4-developers-only.Intel_AMD64.iso'
      -> '/workspace/SilverLABS/SilverMetal/build-a/Kicksecure-CLI-18.1.7.4-developers-only.Intel_AMD64.iso'

…but build-inner.sh then died on its own post-build collection step:

    find: '.../live-build/chroot/usr/src': Permission denied
    find: '.../live-build/chroot/etc/sudoers.d': Permission denied
    find: '.../live-build/chroot/boot': Permission denied
    …

The chroot's standard hardened subdirs (/usr/src, /etc/sudoers.d,
/etc/cron.*, /boot, /root, /run/{sudo,lvm,cryptsetup,openvpn-{client,
server}}, cache/bootstrap/root) are 0700 root-owned because the
live-build chroot was assembled under sudo. As `user` (uid 1000) we
can't descend them. find emits Permission denied on each, exits with
status 1, and `set -euo pipefail` in build-inner.sh propagates that
through `xargs cp` and aborts — even though the ISO copy itself had
already succeeded a few lines earlier in the same xargs stream.

Fix: redirect find's stderr to /dev/null and tolerate non-zero exit on
both the *.iso and *.manifest scans. build.sh already verifies an ISO
landed in BUILD_DIR (exit 4 with "no ISO produced" if not), so a real
miss is still caught — we just stop killing the script for the benign
unreadable-chroot-subdirs case.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 18:32:00 +01:00

7.1 KiB

Executable File

Raw Blame History

View Raw