Description
Since 2.4.2, poetry install fails as root while extracting an sdist on Pythons whose tarfile has no data_filter. We hit it in a Docker build on python:3.10.4-bullseye with crontab 1.0.4, facepy 1.0.12 and PyMeeus 0.5.12, which have no wheel on PyPI.
On these Pythons extractall() in poetry/utils/helpers.py uses the ported CPython 3.14 data filter added in #11027. The filter sets uid, gid, uname and gname to None, and members are then extracted with archive.extract(member, dest, set_attrs=not member.isdir()). As root, tarfile._extract_member() calls chown(), where these Python versions have no None guard:
# CPython 3.10.11, tarfile.py
try:
if grp:
g = grp.getgrnam(tarinfo.gname)[2]
except KeyError:
pass
grp.getgrnam(None) raises TypeError, which is not caught, and the install aborts. CPython has if grp and tarinfo.gname: there from 3.10.12 and 3.11.4 on.
Checked with the same command, poetry install --no-root of crontab==1.0.4 as root:
| Python |
poetry 2.4.2 |
poetry 2.4.1 |
| 3.10.4 |
fails |
ok |
| 3.10.11 |
fails |
not checked |
| 3.10.12 |
ok |
not checked |
| 3.11.3 |
fails |
not checked |
| 3.11.4 |
ok |
not checked |
| 3.10.18 |
ok |
not checked |
In 2.4.1 the same fallback branch validated member paths only and did not change ownership attributes.
Reproduction
$ docker run --rm -u root python:3.10.4-bullseye bash -c '
pip install -q "poetry==2.4.2"
mkdir /t && cd /t
printf "[project]\nname=\"repro\"\nversion=\"0.1.0\"\nrequires-python=\">=3.10\"\ndependencies=[\"crontab==1.0.4\"]\n" > pyproject.toml
POETRY_VIRTUALENVS_CREATE=false poetry install --no-root'
The same command with poetry==2.4.1 succeeds.
Workarounds
- Run the install as a non-root user, verified on
python:3.10.4-bullseye with 2.4.2.
- Use Python 3.10.12+ or 3.11.4+, verified above.
- Pin
poetry==2.4.1.
Poetry Installation Method: pip
Operating System: Debian 11 (python:3.10.4-bullseye container), also seen on GitHub Actions ubuntu-24.04
Poetry Version: 2.4.2
Poetry Configuration
cache-dir = "/root/.cache/pypoetry"
installer.max-workers = null
installer.no-binary = null
installer.only-binary = null
installer.parallel = true
installer.re-resolve = false
solver.lazy-wheel = true
virtualenvs.create = false
Poetry Runtime Logs
poetry-runtime.log
5 poetry/installation/chef.py:60 in prepare
→ 60│ return self._prepare_sdist(
4 poetry/installation/chef.py:106 in _prepare_sdist
→ 106│ extractall(source=archive, dest=archive_dir, zip=zip)
3 poetry/utils/helpers.py:529 in extractall
→ 529│ archive.extract(member, dest, set_attrs=not member.isdir())
2 /usr/local/lib/python3.10/tarfile.py:2090 in extract
→ 2090│ self._extract_member(tarinfo, os.path.join(path, tarinfo.name),
1 /usr/local/lib/python3.10/tarfile.py:2178 in _extract_member
→ 2178│ self.chown(tarinfo, targetpath, numeric_owner)
TypeError
getgrnam() argument 'name' must be str, not None
at /usr/local/lib/python3.10/tarfile.py:2284 in chown
2283│ if grp:
→ 2284│ g = grp.getgrnam(tarinfo.gname)[2]
Cannot install crontab.
Description
Since 2.4.2,
poetry installfails as root while extracting an sdist on Pythons whosetarfilehas nodata_filter. We hit it in a Docker build onpython:3.10.4-bullseyewithcrontab 1.0.4,facepy 1.0.12andPyMeeus 0.5.12, which have no wheel on PyPI.On these Pythons
extractall()inpoetry/utils/helpers.pyuses the ported CPython 3.14 data filter added in #11027. The filter setsuid,gid,unameandgnametoNone, and members are then extracted witharchive.extract(member, dest, set_attrs=not member.isdir()). As root,tarfile._extract_member()callschown(), where these Python versions have noNoneguard:grp.getgrnam(None)raisesTypeError, which is not caught, and the install aborts. CPython hasif grp and tarinfo.gname:there from 3.10.12 and 3.11.4 on.Checked with the same command,
poetry install --no-rootofcrontab==1.0.4as root:In 2.4.1 the same fallback branch validated member paths only and did not change ownership attributes.
Reproduction
The same command with
poetry==2.4.1succeeds.Workarounds
python:3.10.4-bullseyewith 2.4.2.poetry==2.4.1.Poetry Installation Method: pip
Operating System: Debian 11 (
python:3.10.4-bullseyecontainer), also seen on GitHub Actionsubuntu-24.04Poetry Version: 2.4.2
Poetry Configuration
Poetry Runtime Logs
poetry-runtime.log