Installing wheel with different users

When attempting to install a wheel pip install package.whl with user user2, when the package had previously been installed with user1, I am seeing a OSError: [Errno 1] Operation not permitted: 'filname'.

This is on Ubuntu 14.10, user1 and user2 are both in group group, and the file which fails has permissions -rw-rw-r--, owned by user1 and group, so I would expect this to not fail.

This appears to be caused by shutil.copy2 in clobber() in wheel.py. Specifically, I am seeing the following behaviour (file is owned by user2 and group, running python as user1).

os.utime("file", None) -> Succeeds os.utime("file", (1415962103.9824536, 1415962103.9384534)) -> Fails

Exception:
Traceback (most recent call last):
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/basecommand.py", line 122, in main
    status = self.run(options, args)
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/commands/install.py", line 283, in run
    requirement_set.install(install_options, global_options, root=options.root_path)
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/req.py", line 1435, in install
    requirement.install(install_options, global_options, *args, **kwargs)
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/req.py", line 671, in install
    self.move_wheel_files(self.source_dir, root=root)
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/req.py", line 901, in move_wheel_files
    pycompile=self.pycompile,
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/wheel.py", line 141, in move_wheel_files
    if not scheme:
  File "/home/user2/env/local/lib/python2.7/site-packages/pip/wheel.py", line 210, in clobber
    shutil.copy2(srcfile, destfile)
  File "/usr/lib/python2.7/shutil.py", line 131, in copy2
    copystat(src, dst)
  File "/usr/lib/python2.7/shutil.py", line 98, in copystat
    os.utime(dst, (st.st_atime, st.st_mtime))
OSError: [Errno 1] Operation not permitted: '/home/user2/env/lib/python2.7/site-packages/package/extensions.py'

[hamsolodev]

I do not think pip should be trying to set atime and mtime to arbitrary values when installing wheels, at least not when file owners do not match, as it would seem that this is something UNIX (or Linux at least) expressly forbids when operating on files owned by someone other than the current user (a common scenario in shared virtualenv environments.)

$ ls -l
total 4.0K
-rw-rw-r-- 1 mch mch   0 Apr 11 11:47 file_1
-rw-rw-r-- 1 mpd mch   0 Apr 11 11:39 file_2

Setting atime/mtime to current time of files you do not own is allowed (as long as you have write permission on the containing dir)

$ touch file_2
$ ls -l file_2
-rw-rw-r-- 1 mpd mch 0 Apr 11 13:04 file_2

Setting atime/mtime to an arbitrary value (here taken from file_1) is not allowed (more or less permissive permissions have no effect)

$ touch -r file_1 file_2
touch: setting times of 'file_2': Operation not permitted

[pfmoore]

I agree, I’d say this isn’t supported usage. We expect the user to have permission to install files in the target directory, this is just a manifestation of that.