threads / patch / 64291

patchci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

Subject: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

## tl;dr

6 messages between Oct 10, 2025 and Oct 13, 2025. Diffs are folded; open one to read it.

replies: 5people: 3as markdown or json

Patrick Steinhardt· Oct 10, 2025, 09:41 UTC · lore

Ubuntu 25.10 has been released. One prominent change in this version of Ubuntu is the switch to some Rust-based utilities. Part of this switch is also that Ubuntu now defaults to sudo-rs(1).

Unfortunately, this breaks our CI because sudo-rs(1) does not support the `--preserve-env` flag. Let's revert back to the C-based sudo(1) implementation to fix this.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
---
Hi,

this breaks a bunch of our CI jobs, both for GitHub and GitLab. It would probably make sense to fast-track the fix.

Thanks!

Patrick
---
 ci/install-dependencies.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

Show changes to ci/install-dependencies.sh +9 −0

diff --git a/ci/install-dependencies.sh b/ci/install-dependencies.sh
index 0d3aa496fc..a8dcd9b9bc 100755
--- a/ci/install-dependencies.sh
+++ b/ci/install-dependencies.sh
@@ -65,6 +65,15 @@ ubuntu-*|i386/ubuntu-*|debian-*)
 		libsecret-1-dev libpcre2-dev meson ninja-build pkg-config cargo \
 		${CC_PACKAGE:-${CC:-gcc}} $PYTHON_PACKAGE
 
+	# Starting with Ubuntu 25.10, sudo can now be provided via either
+	# sudo(1) or sudo-rs(1), with the latter being the default. The problem
+	# is that it does not support `--preserve-env` though, which we rely on
+	# in our CI. We thus revert back to the C implementation.
+	if test -f /etc/alternatives/sudo
+	then
+		sudo update-alternatives --set sudo /usr/bin/sudo.ws
+	fi
+
 	case "$distro" in
 	ubuntu-*)
 		mkdir --parents "$CUSTOM_PATH"

---
base-commit: 60f3f52f17cceefa5299709b189ce6fe2d181e7b
change-id: 20251010-b4-pks-ci-ubuntu-sudo-rs-8e992b87ddf0

Junio C Hamano· Oct 10, 2025, 16:44 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

Patrick Steinhardt <ps@pks.im> writes:

Show 14 quoted lines

> Ubuntu 25.10 has been released. One prominent change in this version of
> Ubuntu is the switch to some Rust-based utilities. Part of this switch
> is also that Ubuntu now defaults to sudo-rs(1).
>
> Unfortunately, this breaks our CI because sudo-rs(1) does not support
> the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
> implementation to fix this.
>
> Signed-off-by: Patrick Steinhardt <ps@pks.im>
> ---
> Hi,
>
> this breaks a bunch of our CI jobs, both for GitHub and GitLab. It would
> probably make sense to fast-track the fix.

It is curious why this is done outside Ubuntu. The context is that the outermost case "$distro" has this arm

    ubuntu-*|i386/ubuntu-*|debian-*)

which is where the patched code appears.

Show 12 quoted lines

> @@ -65,6 +65,15 @@ ubuntu-*|i386/ubuntu-*|debian-*)
>  		libsecret-1-dev libpcre2-dev meson ninja-build pkg-config cargo \
>  		${CC_PACKAGE:-${CC:-gcc}} $PYTHON_PACKAGE
>  
> +	# Starting with Ubuntu 25.10, sudo can now be provided via either
> +	# sudo(1) or sudo-rs(1), with the latter being the default. The problem
> +	# is that it does not support `--preserve-env` though, which we rely on
> +	# in our CI. We thus revert back to the C implementation.
> +	if test -f /etc/alternatives/sudo
> +	then
> +		sudo update-alternatives --set sudo /usr/bin/sudo.ws
> +	fi

So at least shouldn't we be limiting ourselves to do this only when /usr/bin/sudo.ws exists? Or do it in the nested case "$distro" that immediately follows this one to limit the effect only to Ubuntu (which may need to make this into a helper function that is called for both ubuntu-* and i386/ubuntu-* arms)?

>  	case "$distro" in
>  	ubuntu-*)
>  		mkdir --parents "$CUSTOM_PATH"

Thanks.

Patrick Steinhardt· Oct 11, 2025, 10:57 UTC · re: Junio C Hamano · lore

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

On Fri, Oct 10, 2025 at 09:44:44AM -0700, Junio C Hamano wrote:

Show 19 quoted lines

> Patrick Steinhardt <ps@pks.im> writes:
> > @@ -65,6 +65,15 @@ ubuntu-*|i386/ubuntu-*|debian-*)
> >  		libsecret-1-dev libpcre2-dev meson ninja-build pkg-config cargo \
> >  		${CC_PACKAGE:-${CC:-gcc}} $PYTHON_PACKAGE
> >  
> > +	# Starting with Ubuntu 25.10, sudo can now be provided via either
> > +	# sudo(1) or sudo-rs(1), with the latter being the default. The problem
> > +	# is that it does not support `--preserve-env` though, which we rely on
> > +	# in our CI. We thus revert back to the C implementation.
> > +	if test -f /etc/alternatives/sudo
> > +	then
> > +		sudo update-alternatives --set sudo /usr/bin/sudo.ws
> > +	fi
> 
> So at least shouldn't we be limiting ourselves to do this only when
> /usr/bin/sudo.ws exists?  Or do it in the nested case "$distro" that
> immediately follows this one to limit the effect only to Ubuntu
> (which may need to make this into a helper function that is called
> for both ubuntu-* and i386/ubuntu-* arms)?

No other distro has this sudo.ws / sudo-rs split at the current point in time, and because of this they don't have /etc/alternatives/sudo, either. So for now at least the condition should be sufficient, I think.

If we want to tighten this we could probably make this something like "if test -f /etc/alternatives/sudo && test -f /usr/bin/sudo.ws". But to be honest, I feel like all variants are somewhat brittle here and there's scenarios where all of them will fail with upstream changes. So I feel like the current version is good enough, but I'm happy to adjust if you continue to feel otherwise.

Also, we don't have to do this for i386/ubuntu. Ubuntu has dropped 32 bit support, so it won't ever adopt this split. I have a patch series pending that'll convert this CI job to instead use i386/debian, which still continues to maintain 32 bit.

Thanks!

Patrick

brian m. carlson· Oct 10, 2025, 21:33 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

On 2025-10-10 at 09:41:14, Patrick Steinhardt wrote:

Show 7 quoted lines

> Ubuntu 25.10 has been released. One prominent change in this version of
> Ubuntu is the switch to some Rust-based utilities. Part of this switch
> is also that Ubuntu now defaults to sudo-rs(1).
> 
> Unfortunately, this breaks our CI because sudo-rs(1) does not support
> the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
> implementation to fix this.

I've requested that functionality (which I also use in a variety of cases) upstream: https://github.com/trifectatechfoundation/sudo-rs/issues/1299. Hopefully it can be implemented in time for Ubuntu 26.04.

-- 
brian m. carlson (they/them)
Toronto, Ontario, CA

Patrick Steinhardt· Oct 11, 2025, 10:57 UTC · re: brian m. carlson · lore

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

On Fri, Oct 10, 2025 at 09:33:00PM +0000, brian m. carlson wrote:

Show 13 quoted lines

> On 2025-10-10 at 09:41:14, Patrick Steinhardt wrote:
> > Ubuntu 25.10 has been released. One prominent change in this version of
> > Ubuntu is the switch to some Rust-based utilities. Part of this switch
> > is also that Ubuntu now defaults to sudo-rs(1).
> > 
> > Unfortunately, this breaks our CI because sudo-rs(1) does not support
> > the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
> > implementation to fix this.
> 
> I've requested that functionality (which I also use in a variety of
> cases) upstream:
> https://github.com/trifectatechfoundation/sudo-rs/issues/1299.
> Hopefully it can be implemented in time for Ubuntu 26.04.

Awesome, thanks!

Patrick

Junio C Hamano· Oct 13, 2025, 14:27 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)

Patrick Steinhardt <ps@pks.im> writes:

Show 16 quoted lines

> On Fri, Oct 10, 2025 at 09:33:00PM +0000, brian m. carlson wrote:
>> On 2025-10-10 at 09:41:14, Patrick Steinhardt wrote:
>> > Ubuntu 25.10 has been released. One prominent change in this version of
>> > Ubuntu is the switch to some Rust-based utilities. Part of this switch
>> > is also that Ubuntu now defaults to sudo-rs(1).
>> > 
>> > Unfortunately, this breaks our CI because sudo-rs(1) does not support
>> > the `--preserve-env` flag. Let's revert back to the C-based sudo(1)
>> > implementation to fix this.
>> 
>> I've requested that functionality (which I also use in a variety of
>> cases) upstream:
>> https://github.com/trifectatechfoundation/sudo-rs/issues/1299.
>> Hopefully it can be implemented in time for Ubuntu 26.04.
>
> Awesome, thanks!

Yeah, solving the problem at its root instead of having to work around is a good thing to do.

Thanks.