PATH auto extended with stage paths
Metadata
Current evaluation
Cross-builds can prepend target-architecture staged binaries to a part's build PATH, executing tools such as Python from the wrong architecture. Maintainers acknowledged the defect, which remains open.
Suggested action: keep open
Reason: The maintainer explicitly agreed that staged bin directories should not be added to PATH when cross-compiling and identified the responsible craft-parts environment code. Current craft-parts still constructs the part PATH from collected bin paths before $PATH, so there is no evidence of a fix; the unresolved choice between cross-build-only behavior and a YAML option adds some implementation complexity.
Evaluated by: mr-cal-bot
Impact:
58
Quick Win:
25
Complexity:
44
Confidence:
92
Actionability:
76
Issue body
snapcraft automatically adds <stage>/usr/bin and <stage>/usr/sbin, additionally those paths are added to the beginning.
This would usually work for native builds, but causes problems when running cross builds
e.g. including python in the snap, would make the next part fail, if it tries to use python from the stage directory, which is of the wrong architecture.
As a minimum, this should be avoided if cross-build is detected.
It is still questionable if this should be the default behaviour rather than in control of the snapcraft.yaml
e.g. staging JRE in the snap, vs using JDK from the build environment.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
25
Complexity:
44
Confidence:
92
Actionability:
76
|
keep open | Cross-builds can prepend target-architecture staged binaries to a part's build PATH, executing tools such as Python from the wrong architecture. Maintainers acknowledged the defect, which remains open. | |
| stealth/space-bunny-alpha |
Impact:
52
Quick Win:
20
Complexity:
50
Confidence:
91
Actionability:
78
|
keep open | Cross-build part environments still prepend part-install and stage bin directories to PATH, risking execution of target-architecture tools such as Python; maintainers agreed this should change. | |
| stealth/space-bunny-alpha |
Impact:
46
Quick Win:
14
Complexity:
48
Confidence:
75
Actionability:
58
|
needs triage | Untriaged report: staged usr/bin and usr/sbin precede PATH during builds, potentially invoking target-architecture tools during cross-builds. The policy and need for configuration remain unresolved. | |
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
13
Complexity:
60
Confidence:
79
Actionability:
55
|
needs triage | Staged bin directories are prepended to PATH, potentially shadowing build tools with wrong-architecture programs during cross-builds; untriaged, with no complete reproducer or maintainer feedback. | |
| stealth/space-bunny-alpha |
Impact:
50
Quick Win:
17
Complexity:
45
Confidence:
92
Actionability:
62
|
needs triage | Untriaged report: staged usr/bin and usr/sbin paths remain prepended, potentially selecting target-architecture tools during cross-builds. No labels or maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
50
Quick Win:
22
Staleness:
85
Complexity:
55
Confidence:
60
Support Request:
20
|
needs triage | Issue about snapcraft auto-extending PATH with stage paths causing cross-build failures. Untriaged, 1261 days old, no comments or labels. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
65
Confidence:
80
Support Request:
10
|
needs triage | Snapcraft prepends stage paths to PATH, causing architecture mismatches during cross-builds. The report is unlabelled, has zero maintainer comments, and has been inactive for over three years. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
65
Confidence:
85
Support Request:
15
|
needs triage | Snapcraft automatically prepends stage paths to PATH, causing architecture mismatches in cross-builds. Unlabeled, no maintainer response, inactive for over 3 years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
65
Confidence:
80
Support Request:
15
|
needs triage | Snapcraft automatically prepends stage paths to PATH, causing cross-build architecture mismatches. Unlabeled, zero maintainer comments, inactive for over three years. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.