uv pip install works inside the sandbox (validates Landlock V2 REFER support). Under Landlock V1 this would fail with EXDEV (cross-device link, os error 18) because uv uses cross-directory rename() for cache population and installation. Landlock V2 adds the REFER right which permits thi
(
sandbox: Callable[..., Sandbox],
)
| 64 | |
| 65 | |
| 66 | def test_uv_pip_install_in_sandbox( |
| 67 | sandbox: Callable[..., Sandbox], |
| 68 | ) -> None: |
| 69 | """uv pip install works inside the sandbox (validates Landlock V2 REFER support). |
| 70 | |
| 71 | Under Landlock V1 this would fail with EXDEV (cross-device link, os error 18) |
| 72 | because uv uses cross-directory rename() for cache population and installation. |
| 73 | Landlock V2 adds the REFER right which permits this. |
| 74 | """ |
| 75 | with sandbox(delete_on_exit=True) as sb: |
| 76 | install = sb.exec( |
| 77 | [ |
| 78 | "uv", |
| 79 | "pip", |
| 80 | "install", |
| 81 | "--python", |
| 82 | "/sandbox/.venv/bin/python", |
| 83 | "--quiet", |
| 84 | "cowsay", |
| 85 | ], |
| 86 | timeout_seconds=60, |
| 87 | ) |
| 88 | assert install.exit_code == 0, ( |
| 89 | f"uv pip install failed:\nstdout: {install.stdout}\nstderr: {install.stderr}" |
| 90 | ) |
| 91 | |
| 92 | # Verify the package is importable |
| 93 | verify = sb.exec( |
| 94 | ["python", "-c", "import cowsay; print(cowsay.char_names[0])"], |
| 95 | timeout_seconds=20, |
| 96 | ) |
| 97 | assert verify.exit_code == 0, ( |
| 98 | f"import failed after uv install:\n" |
| 99 | f"stdout: {verify.stdout}\nstderr: {verify.stderr}" |
| 100 | ) |
| 101 | assert verify.stdout.strip(), "Expected non-empty output from cowsay" |
| 102 | |
| 103 | |
| 104 | def test_uv_run_with_ephemeral_dependency( |