src: run snapcraft under "sudo -u $user -E" rather than using "sg"

canonical · Jul 15, 2024 · a3cebbe · a3cebbe
1 parent 2028b21
commit a3cebbe
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 22 deletions.
diff --git a/__tests__/build.test.ts b/__tests__/build.test.ts
@@ -64,18 +64,23 @@ test('SnapcraftBuilder.build runs a snap build', async () => {
   })
   await builder.build()
 
+  const user = os.userInfo().username
   expect(ensureSnapd).toHaveBeenCalled()
   expect(ensureLXD).toHaveBeenCalled()
   expect(ensureSnapcraft).toHaveBeenCalled()
-  expect(execMock).toHaveBeenCalledWith('sg', ['lxd', '-c', 'snapcraft'], {
-    cwd: projectDir,
-    env: expect.objectContaining({
-      SNAPCRAFT_BUILD_ENVIRONMENT: 'lxd',
-      SNAPCRAFT_BUILD_INFO: '1',
-      SNAPCRAFT_IMAGE_INFO:
-        '{"build_url":"https://github.com/user/repo/actions/runs/42"}'
-    })
-  })
+  expect(execMock).toHaveBeenCalledWith(
+    'sudo',
+    ['-u', user, '-E', 'snapcraft'],
+    {
+      cwd: projectDir,
+      env: expect.objectContaining({
+        SNAPCRAFT_BUILD_ENVIRONMENT: 'lxd',
+        SNAPCRAFT_BUILD_INFO: '1',
+        SNAPCRAFT_IMAGE_INFO:
+          '{"build_url":"https://github.com/user/repo/actions/runs/42"}'
+      })
+    }
+  )
 })
 
 test('SnapcraftBuilder.build can disable build info', async () => {
@@ -107,7 +112,7 @@ test('SnapcraftBuilder.build can disable build info', async () => {
   })
   await builder.build()
 
-  expect(execMock).toHaveBeenCalledWith('sg', expect.any(Array), {
+  expect(execMock).toHaveBeenCalledWith('sudo', expect.any(Array), {
     cwd: expect.any(String),
     env: expect.not.objectContaining({
       // No SNAPCRAFT_BUILD_INFO variable
@@ -177,9 +182,10 @@ test('SnapcraftBuilder.build can pass additional arguments', async () => {
   })
   await builder.build()
 
+  const user = os.userInfo().username
   expect(execMock).toHaveBeenCalledWith(
-    'sg',
-    ['lxd', '-c', 'snapcraft --foo --bar'],
+    'sudo',
+    ['-u', user, '-E', 'snapcraft', '--foo', '--bar'],
     expect.anything()
   )
 })
@@ -213,9 +219,10 @@ test('SnapcraftBuilder.build can pass UA token', async () => {
   })
   await builder.build()
 
+  const user = os.userInfo().username
   expect(execMock).toHaveBeenCalledWith(
-    'sg',
-    ['lxd', '-c', 'snapcraft --ua-token test-ua-token'],
+    'sudo',
+    ['-u', user, '-E', 'snapcraft', '--ua-token', 'test-ua-token'],
     expect.anything()
   )
 })

diff --git a/dist/index.js b/dist/index.js
@@ -27283,14 +27283,15 @@ class SnapcraftBuilder {
         if (this.includeBuildInfo) {
             env['SNAPCRAFT_BUILD_INFO'] = '1';
         }
-        let snapcraft = 'snapcraft';
+        const snapcraft = ['snapcraft'];
         if (this.snapcraftArgs) {
-            snapcraft = `${snapcraft} ${this.snapcraftArgs}`;
+            snapcraft.push(...this.snapcraftArgs.split(/\s+/));
         }
         if (this.uaToken) {
-            snapcraft = `${snapcraft} --ua-token ${this.uaToken}`;
+            snapcraft.push('--ua-token', this.uaToken);
         }
-        await exec.exec('sg', ['lxd', '-c', snapcraft], {
+        const user = external_os_.userInfo().username;
+        await exec.exec('sudo', ['-u', user, '-E'].concat(snapcraft), {
             cwd: this.projectRoot,
             env
         });

diff --git a/src/build.ts b/src/build.ts
@@ -67,15 +67,16 @@ export class SnapcraftBuilder {
       env['SNAPCRAFT_BUILD_INFO'] = '1'
     }
 
-    let snapcraft = 'snapcraft'
+    const snapcraft = ['snapcraft']
     if (this.snapcraftArgs) {
-      snapcraft = `${snapcraft} ${this.snapcraftArgs}`
+      snapcraft.push(...this.snapcraftArgs.split(/\s+/))
     }
     if (this.uaToken) {
-      snapcraft = `${snapcraft} --ua-token ${this.uaToken}`
+      snapcraft.push('--ua-token', this.uaToken)
     }
 
-    await exec.exec('sg', ['lxd', '-c', snapcraft], {
+    const user = os.userInfo().username
+    await exec.exec('sudo', ['-u', user, '-E'].concat(snapcraft), {
       cwd: this.projectRoot,
       env
     })