contrib: android: Dockerfile: fix ownership of COPY
What the developer wrote
Authored by Aaron Fiore
contrib: android: Dockerfile: fix ownership of COPY
Resolves:
ERROR: Could not open requirements file: [Errno 13] Permission
denied: '/opt/deterministic-build/requirements-build-base.txt'
What changed, and why it matters
This commit fixes a file-permission problem inside the Android build container. Two requirement files were being copied as the root user, so the non-root build user could not read them. The fix makes the files owned by the build user. There is no security vulnerability here—just a broken build step.
No security action required. Treat as a normal build/maintenance fix.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The Dockerfile copies deterministic Python requirement files into /opt/deterministic-build. Without –chown=user, Docker’s COPY instruction leaves them owned by root (UID 0). A later RUN step executes as the non-root ‘user’, causing pip to fail with Errno 13 (Permission denied) when opening the requirements files. Adding –chown=user sets the destination owner to the build user, restoring readability. This is a build-fix, not a privilege-escalation or sandbox escape.
Changed components
contrib/android/DockerfileInspect captured patch +2 / −2
diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index b1615bb..be455d1 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -232,8 +232,8 @@ ENV VIRTUAL_ENV=/opt/venv
RUN "/opt/cpython/install/bin/python3" -m venv ${VIRTUAL_ENV}
ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
-COPY contrib/deterministic-build/requirements-build-base.txt /opt/deterministic-build/
-COPY contrib/deterministic-build/requirements-build-android.txt /opt/deterministic-build/
+COPY --chown=user contrib/deterministic-build/requirements-build-base.txt /opt/deterministic-build/
+COPY --chown=user contrib/deterministic-build/requirements-build-android.txt /opt/deterministic-build/
RUN /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies \
-r /opt/deterministic-build/requirements-build-base.txt
RUN /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies --no-binary :all: \
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.