Install bubblewrap in CI before Linux formula builds#22
Merged
Conversation
Homebrew 6.0 sandboxes Linux source builds with Bubblewrap and aborts with a fatal error when a rootless bwrap is not on PATH. The ubuntu-latest runner image doesn't ship it, and a brewed bubblewrap isn't picked up by the sandbox check (it prefers a system bwrap), so install the apt package in a pre-step before brew install. Fixes the Linux test-formula jobs.
marcqualie
force-pushed
the
add-linux-bubblewrap-dependency
branch
from
8eff2ea to
e187c9b
Compare
marcqualie
changed the title
Installing the bubblewrap package alone wasn't enough: ubuntu-latest (24.04) blocks unprivileged user namespaces via AppArmor, so rootless bwrap can't create its sandbox and brew install still aborts. Relax the unprivileged-userns sysctls in the pre-step so the sandbox can run.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Homebrew 6.0.0 (released ~2026-06-12) enables a Bubblewrap-based sandbox for Linux source builds by default and adds a fatal pre-build check. When a rootless
bwrapis not onPATH,brew install --build-from-sourceaborts with:Because CI uses
Homebrew/actions/setup-homebrew@master, it picked up 6.0.0 automatically, and theubuntu-latestimage doesn't shipbwrap. This broke the Linuxtest-formulajobs for both formulae, independent of any formula change.Why not a formula
depends_onA first attempt added
bubblewrapas a Linux-only formula dependency. It doesn't work: the bottle is poured, but Homebrew's sandbox check prefers a systembwrapand runs before the brewed keg is usable, so it still reports "not found." The fix has to makebwrapavailable on the system PATH beforebrew installruns.Fix
Add a CI pre-step that installs the
bubblewrapapt package on Linux (landsbwrapin/usr/bin) beforebrew install. Keeps the sandbox active rather than disabling it withHOMEBREW_NO_SANDBOX_LINUX.