uv Spawning subprocess in build backend fails due to group policy

Spawning subprocess in build backend fails due to group policy

Open kylewardlow opened this issue 5 months ago • 7 comments

Summary

Subtitle: (uv attempting to run executables in AppLocker restricted directory based on hard-to-configure uv defaults)

General notes about development environment: Running in a restrictive corporate IT environment with Applocker blocking executables out of C:\Users and block banning the execution of e.g. .msi files.

Proposed solution: add hook to install scripts to let users choose install directory.

Command: uv sync

Output with --verbose:

$ uv sync --verbose
DEBUG uv 0.7.12 (dc3fd4647 2025-06-06)
DEBUG Found project root: `C:\Appl\src\application-services`
DEBUG No workspace root found, using project root
DEBUG Acquired lock for `C:\Appl\src\application-services`
DEBUG Reading Python requests from version file at `C:\Appl\src\application-services\.python-version`
DEBUG Using Python request `3.11` from version file at `.python-version`
DEBUG Checking for Python environment at `.venv`
DEBUG The project environment's Python version satisfies the request: `Python 3.11`
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\Temp\uv-ab623d15c6505a00.lock`
DEBUG Acquired lock for `.venv`
DEBUG Using request timeout of 30s
DEBUG Ignoring existing lockfile due to mismatched source: `application-services` (expected: `editable`)
DEBUG Found static `pyproject.toml` for: application-services @ file:///C:/Appl/application-services
DEBUG No workspace root found, using project root
DEBUG Solving with installed Python version: 3.11.5
DEBUG Solving with target Python version: >=3.11
DEBUG Adding direct dependency: application-services*
DEBUG Searching for a compatible version of application-services @ file:///C:/Appl/application-services (*)
DEBUG Adding direct dependency: googleapis-common-protos>=1.70.0
DEBUG Adding direct dependency: grpcio>=1.73.0
DEBUG Adding direct dependency: grpcio-tools>=1.73.0
DEBUG Adding direct dependency: protobuf>=6.31.1
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\googleapis-common-protos.lock`
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\grpcio.lock`
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\grpcio-tools.lock`
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\protobuf.lock`
DEBUG Found stale response for: https://pypi.org/simple/googleapis-common-protos/
DEBUG Sending revalidation request for: https://pypi.org/simple/googleapis-common-protos/
DEBUG Found stale response for: https://pypi.org/simple/protobuf/
DEBUG Sending revalidation request for: https://pypi.org/simple/protobuf/
DEBUG Found stale response for: https://pypi.org/simple/grpcio/
DEBUG Sending revalidation request for: https://pypi.org/simple/grpcio/
DEBUG Found stale response for: https://pypi.org/simple/grpcio-tools/
DEBUG Sending revalidation request for: https://pypi.org/simple/grpcio-tools/
DEBUG Found not-modified response for: https://pypi.org/simple/grpcio/
DEBUG Found not-modified response for: https://pypi.org/simple/protobuf/
DEBUG Found not-modified response for: https://pypi.org/simple/grpcio-tools/
DEBUG Found not-modified response for: https://pypi.org/simple/googleapis-common-protos/
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\protobuf.lock`
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\grpcio.lock`
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\googleapis-common-protos.lock`
DEBUG Searching for a compatible version of googleapis-common-protos (>=1.70.0)
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\grpcio-tools.lock`
DEBUG Selecting: googleapis-common-protos==1.70.0 [preference] (googleapis_common_protos-1.70.0-py3-none-any.whl)
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\protobuf\protobuf-6.31.1-cp310-abi3-win32.lock`
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\grpcio\grpcio-1.73.1-cp311-cp311-linux_armv7l.lock`
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\grpcio-tools\grpcio_tools-1.73.1-cp311-cp311-linux_armv7l.lock`
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\googleapis-common-protos\googleapis_common_protos-1.70.0-py3-none-any.lock`
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/86/f1/62a193f0227cf15a920390abe675f386dec35f7ae3ffe6da582d3ade42c7/googleapis_common_protos-1.70.0-py3-none-any.whl.metadata
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\googleapis-common-protos\googleapis_common_protos-1.70.0-py3-none-any.lock`
DEBUG Adding transitive dependency for googleapis-common-protos==1.70.0: protobuf>=3.20.2, <4.21.1 | >=4.21.1+, <4.21.2 | >=4.21.2+, <4.21.3 | >=4.21.3+, <4.21.4 | >=4.21.4+, <4.21.5 | >=4.21.5+, <7.0.0
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/e4/41/921565815e871d84043e73e2c0e748f0318dab6fa9be872cd042778f14a9/grpcio-1.73.1-cp311-cp311-linux_armv7l.whl.metadata
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\grpcio\grpcio-1.73.1-cp311-cp311-linux_armv7l.lock`
DEBUG Searching for a compatible version of grpcio (>=1.73.0)
DEBUG Selecting: grpcio==1.73.1 [preference] (grpcio-1.73.1-cp311-cp311-linux_armv7l.whl)
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/f3/6f/6ab8e4bf962fd5570d3deaa2d5c38f0a363f57b4501047b5ebeb83ab1125/protobuf-6.31.1-cp310-abi3-win32.whl.metadata
DEBUG Searching for a compatible version of grpcio-tools (>=1.73.0)
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\protobuf\protobuf-6.31.1-cp310-abi3-win32.lock`
DEBUG Selecting: grpcio-tools==1.73.1 [preference] (grpcio_tools-1.73.1-cp311-cp311-linux_armv7l.whl)
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/e0/f0/a1f752fa7a2d62f43ee261238dcaf01661448d443ac7293e2e7462705ae4/grpcio_tools-1.73.1-cp311-cp311-linux_armv7l.whl.metadata
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\grpcio-tools\grpcio_tools-1.73.1-cp311-cp311-linux_armv7l.lock`
DEBUG Adding transitive dependency for grpcio-tools==1.73.1: grpcio>=1.73.1
DEBUG Adding transitive dependency for grpcio-tools==1.73.1: protobuf>=6.30.0, <7.0.0
DEBUG Adding transitive dependency for grpcio-tools==1.73.1: setuptools*
DEBUG Searching for a compatible version of protobuf (>=6.31.1, <7.0.0)
DEBUG Selecting: protobuf==6.31.1 [preference] (protobuf-6.31.1-cp310-abi3-win32.whl)
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\setuptools.lock`
DEBUG Found stale response for: https://pypi.org/simple/setuptools/
DEBUG Sending revalidation request for: https://pypi.org/simple/setuptools/
DEBUG Found not-modified response for: https://pypi.org/simple/setuptools/
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\setuptools.lock`
DEBUG Searching for a compatible version of setuptools (*)
DEBUG Selecting: setuptools==80.9.0 [preference] (setuptools-80.9.0-py3-none-any.whl)
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\setuptools\setuptools-80.9.0-py3-none-any.lock`
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/a3/dc/17031897dae0efacfea57dfd3a82fdd2a2aeb58e0ff71b77b87e44edc772/setuptools-80.9.0-py3-none-any.whl.metadata
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\setuptools\setuptools-80.9.0-py3-none-any.lock`
DEBUG Tried 6 versions: application-services 1, googleapis-common-protos 1, grpcio 1, grpcio-tools 1, protobuf 1, setuptools 1
DEBUG all marker environments resolution took 0.429s
Resolved 6 packages in 569ms
DEBUG Using request timeout of 30s
DEBUG Computed cache info: Some(Timestamp(SystemTime { intervals: 133958649471558719 })), None, None, {}, {"src": Some(Timestamp(Timestamp(SystemTime { intervals: 133933463987043192 })))}
DEBUG Identified uncached distribution: application-services @ file:///C:/Appl/application-services
DEBUG Requirement already installed: googleapis-common-protos==1.70.0
DEBUG Requirement already installed: grpcio==1.73.1
DEBUG Requirement already installed: grpcio-tools==1.73.1
DEBUG Requirement already installed: protobuf==6.31.1
DEBUG Requirement already installed: setuptools==80.9.0
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\sdists-v9\editable\93b062b100978ea9`
DEBUG Computed cache info: Some(Timestamp(SystemTime { intervals: 133958649471558719 })), None, None, {}, {"src": Some(Timestamp(Timestamp(SystemTime { intervals: 133933463987043192 })))}
DEBUG Cached revision does not match expected cache info for: application-services @ file:///C:/Appl/application-services
   Building application-services @ file:///C:/Appl/application-services
DEBUG Building: application-services @ file:///C:/Appl/application-services
DEBUG No workspace root found, using project root
DEBUG Using base executable for virtual environment: C:\Appl\Python\python.exe
DEBUG Ignoring empty directory
DEBUG Resolving build requirements
DEBUG Solving with installed Python version: 3.11.5
DEBUG Solving with target Python version: >=3.11.5
DEBUG Adding direct dependency: uv-build>=0.7.12, <0.8
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\uv-build.lock`
DEBUG Found stale response for: https://pypi.org/simple/uv-build/
DEBUG Sending revalidation request for: https://pypi.org/simple/uv-build/
DEBUG Found not-modified response for: https://pypi.org/simple/uv-build/
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\simple-v16\pypi\uv-build.lock`
DEBUG Searching for a compatible version of uv-build (>=0.7.12, <0.8)
DEBUG Selecting: uv-build==0.7.17 [compatible] (uv_build-0.7.17-py3-none-win_amd64.whl)
DEBUG Acquired lock for `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\uv-build\uv_build-0.7.17-py3-none-win_amd64.lock`
DEBUG Found fresh response for: https://files.pythonhosted.org/packages/50/cc/488fd712692dea1680e71270d985ca3865ee53e80acf15ee8e30e80faccb/uv_build-0.7.17-py3-none-win_amd64.whl.metadata
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\wheels-v5\pypi\uv-build\uv_build-0.7.17-py3-none-win_amd64.lock`
DEBUG Tried 1 versions: uv-build 1
DEBUG marker environment resolution took 0.085s
DEBUG Installing in uv-build==0.7.17 in C:\Users\USERNAME\AppData\Local\uv\cache\builds-v0\.tmpSJh3Vi
DEBUG Registry requirement already cached: uv-build==0.7.17
DEBUG Installing build requirement: uv-build==0.7.17
DEBUG Creating PEP 517 build environment
DEBUG Calling `uv_build.get_requires_for_build_editable()`
DEBUG No workspace root found, using project root
DEBUG Calling `uv_build.build_editable("C:\\Users\\USERNAME\\AppData\\Local\\uv\\cache\\builds-v0\\.tmpuVIaAF", {}, None)`
DEBUG Traceback (most recent call last):
DEBUG   File "<string>", line 11, in <module>
DEBUG   File "C:\Users\USERNAME\AppData\Local\uv\cache\builds-v0\.tmpSJh3Vi\Lib\site-packages\uv_build\__init__.py", line 125, in build_editable
DEBUG     return call(args, config_settings)
DEBUG            ^^^^^^^^^^^^^^^^^^^^^^^^^^^
DEBUG   File "C:\Users\USERNAME\AppData\Local\uv\cache\builds-v0\.tmpSJh3Vi\Lib\site-packages\uv_build\__init__.py", line 54, in call
DEBUG     result = subprocess.run(
DEBUG              ^^^^^^^^^^^^^^^
DEBUG   File "C:\Appl\Python\Lib\subprocess.py", line 548, in run
DEBUG     with Popen(*popenargs, **kwargs) as process:
DEBUG          ^^^^^^^^^^^^^^^^^^^^^^^^^^^
DEBUG   File "C:\Appl\Python\Lib\subprocess.py", line 1026, in __init__
DEBUG     self._execute_child(args, executable, preexec_fn, close_fds,
DEBUG   File "C:\Appl\Python\Lib\subprocess.py", line 1538, in _execute_child
DEBUG     hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
DEBUG                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
DEBUG OSError: [WinError 1260] This program is blocked by group policy. For more information, contact your system administrator
DEBUG Released lock at `C:\Users\USERNAME\AppData\Local\uv\cache\sdists-v9\editable\93b062b100978ea9\.lock`
  × Failed to build `application-services @ file:///C:/Appl/application-services`
  ├─▶ The build backend returned an error
  ╰─▶ Call to `uv_build.build_editable` failed (exit code: 1)

      [stderr]
      Traceback (most recent call last):
        File "<string>", line 11, in <module>
        File "C:\Users\USERNAME\AppData\Local\uv\cache\builds-v0\.tmpSJh3Vi\Lib\site-packages\uv_build\__init__.py", line 125, in build_editable
          return call(args, config_settings)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "C:\Users\USERNAME\AppData\Local\uv\cache\builds-v0\.tmpSJh3Vi\Lib\site-packages\uv_build\__init__.py", line 54, in call
          result = subprocess.run(
                   ^^^^^^^^^^^^^^^
        File "C:\Appl\Python\Lib\subprocess.py", line 548, in run
          with Popen(*popenargs, **kwargs) as process:
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "C:\Appl\Python\Lib\subprocess.py", line 1026, in __init__
          self._execute_child(args, executable, preexec_fn, close_fds,
        File "C:\Appl\Python\Lib\subprocess.py", line 1538, in _execute_child
          hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      OSError: [WinError 1260] This program is blocked by group policy. For more information, contact your system administrator

      hint: This usually indicates a problem with the package or the build environment.
DEBUG Released lock at `C:\Appl\src\application-services\.venv\.lock`

I've run into similar issues with the uv self-managed installed using the Powershell script, where a blocked PowerShell API access function caused the script to fail.

Possibly related to 6584. Possibly resolved by storing the uv cache not in C:\Users\{username}\..., but I've run into similar issues with the uv Windows self-managed installation script not working due to trying to use blocked Powershell commands. In general, it would be useful to have an infrequent testing instance done in a simulacrum of a restrictive corporate IT environment -- security is moving away from local admin privileges in the Windows world, even for developers.

If it's possible to allow a user to choose on install where the executables and cached resources will execute, they could choose to run uv in the low protection area of their drive and this would likely go away. You have to dig into the environment variables ($UV_CACHE_DIR, $XDG_BIN_HOME) to fix the consequences of not allowing users to choose their install directory, which may have unintended consequences.

Platform

Windows 11 x86_64, Version 23H2, OS build 22631.5335

Version

uv 0.7.12 (dc3fd4647 2025-06-06)

Python version

Python 3.11.5

Jul 01 '25 18:07 kylewardlow

uv uv copied to clipboard

Spawning subprocess in build backend fails due to group policy

Summary

Platform

Version

Python version

uv
uv copied to clipboard