← Back to issue list

oci: set default PATH when missing or empty

View original Github issue

Metadata

Project
rockcraft
Number
#1113
Type
pull request
State
open
Author
gcomneno
Labels
—
Created
Updated
Closed
—

Current evaluation

Generalizes empty-PATH protection for OCI rocks beyond bare bases: set_default_path() now skopeo-inspects the final image env after set_environment() and writes Pebble.DEFAULT_ENV_PATH only if PATH is missing/empty. Open218 days, 0 reviews, author pinged 3x.

Suggested action: needs review

Reason: The change directly addresses still-open rockcraft#729, whose summary states "Currently only applies to bare bases; PR #725 addressed bare rocks but not the broader generalization", and no commit in main since b81a12c8 ("fix: set PATH on bare-based rocks (#725)") supersedes it. Evidence is only partial though: review status is pending with 0 reviewers, no unresolved comments, and the only CI checks reported are Canonical CLA and labeler (no test/lint jobs actually ran, typical for forks), so the green-CI signal is absent; the author's own comment of 2026-05-24 cites a rebase plus 51 local pytest passes and clean ruff, but main has since changed oci.py substantially (e.g. 1d57173e "feat(oci): improve image history", 0b6ba8bd "feat: skip repacking"), so mergeability is unverified. Reviewers should also weigh that a project explicitly setting `environment: {PATH: ""}` would now be silently overridden, and that every build gains an extra skopeo inspect subprocess.

Evaluated by: mr-cal-bot

Impact: 35 Quick Win: 13 Complexity: 35 Confidence: 72 Actionability: 55

Issue body

### Summary This PR generalizes the empty-`PATH` protection for OCI images (issue #729). Previously this behavior applied only when `base == "bare"`. The final image environment is now inspected for every base, after project-defined environment variables have been applied. ### Behavior - If `PATH` is missing or its final value is empty (`PATH=`), set it to `Pebble.DEFAULT_ENV_PATH`. - If the final `PATH` value is non-empty, preserve it. - When multiple `PATH` entries exist, the last assignment wins. The implementation reads the final image environment through `skopeo inspect` and writes the default only when necessary. ### Packaging order `set_default_path()` runs after `set_environment()`, preventing a project-level `PATH: ""` from overwriting the safe default after validation. ### Tests Unit coverage includes: - `PATH` present: inspect only, no config write; - `PATH` missing: inspect and configure the default; - `PATH` empty: inspect and configure the default; - duplicate `PATH` entries with last-assignment semantics; - package orchestration applying project environment before final `PATH` validation. Validation performed: - focused OCI and package-service suite: 56 passed; - unit suite: 644 passed, 1 environment-dependent APT test deselected; - the deselected APT test fails identically on current `upstream/main` because the local environment lacks the APT package backend; - Ruff check and format check passed for all four changed files; - `git diff --check` passed. Refs #729

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 35
Quick Win: 13
Complexity: 35
Confidence: 72
Actionability: 55
needs review Generalizes empty-PATH protection for OCI rocks beyond bare bases: set_default_path() now skopeo-inspects the final image env after set_environment() and writes Pebble.DEFAULT_ENV_PATH only if PATH is missing/empty. Open218 days, 0 reviews, author pinged 3x.
stealth/space-bunny-alpha
Impact: 38
Quick Win: 17
Complexity: 42
Confidence: 88
Actionability: 75
needs review Generalizes OCI packaging to restore Pebble's default PATH when the final image PATH is missing or empty, with unit coverage. Open, mergeable, and awaiting initial review.
qwen/qwen3.6-35b-a3b
Impact: 55
Quick Win: 21
Complexity: 45
Confidence: 75
Actionability: 70
needs review Generalizes PATH default-setting for OCI images beyond bare bases by inspecting the final image environment with skopeo and setting Pebble.DEFAULT_ENV_PATH only when PATH is missing or empty.
qwen/qwen3.8-27b
Impact: 55
Quick Win: 30
Staleness: 45
Complexity: 45
Confidence: 72
needs review Generalizes empty-PATH protection from bare-only to all OCI bases by inspecting final image env via skopeo. Author rebased and re-verified 31 days ago; no maintainer review yet. CI green, 0 reviewers assigned.
qwen/qwen3.6-35b-a3b
Staleness: 65
Complexity: 20
Confidence: 90
needs review Generalizes empty PATH protection for OCI images by inspecting the final environment and setting a safe default when missing or empty. Currently awaiting maintainer review after author follow-ups.
qwen/qwen3.6-35b-a3b
Staleness: 25
Complexity: 20
Confidence: 85
needs review Generalizes PATH protection for OCI images to apply to all base images, conditionally setting a default via skopeo inspect. Currently awaiting maintainer review with passing CI and unit tests.
qwen3.6-35b-a3b-mtp-q6
Staleness: 20
Complexity: 25
Confidence: 85
needs review Generalizes PATH defaulting for OCI images when missing or empty. Rebased, tests pass, lint clean, awaiting maintainer review after author follow-ups.
qwen3.6-35b-a3b-mtp-q6
Staleness: 40
Complexity: 25
Confidence: 85
needs review Generalizes PATH defaulting for OCI images to apply to all bases, not just bare. Tests pass, author rebased and pinged maintainers. Currently awaiting maintainer review.

Update history

Date Change
updated
updated

Related work

  • Related To: rockcraft#729 (confidence 92%)

    Open issue 'Improve detection/setting of the PATH environment variable' that this PR references ('Refs #729'); PR body states it generalizes the bare-only protection.

  • Related To: rockcraft#725 (confidence 85%)

    Commit b81a12c8 'fix: set PATH on bare-based rocks (#725)' introduced the base=="bare" check in Image.set_default_path that this PR replaces/generalizes.

Related issues

Issue Project State Summary Similarity
#729 Improve detection/setting of the PATH environment variable rockcraft open Generalize empty-PATH detection: oci.py set_default_path() only sets PATH when base == 'bare', so non-bare images with empty PATH stay vulnerable. PR #1113 attempts the generalization; no maintainer decision yet.
72%