Le 08/11/2022 à 01:12, Vít Novotný a écrit :
On Mon, Nov 07, 2022 at 09:20:24PM +0100, Jean Abou Samra wrote:Le 07/11/2022 à 20:59, Vít Novotný a écrit :Furthermore, the error message indicates that this issue might related to Ghostscript rather than Lilypond.It does not. The message iswarning: g_spawn_sync failed (0): gs: Failed to close file descriptor for child process (Operation not permitted) fatal error: cannot rename `document-tmp-2786319.384671.pdf' to `document.pdf' The warning (g_spawn_sync blabla) is emitted by LilyPond due to an error in GhostScript. The second line, the fatal error, is also emitted by LilyPond and has absolutely nothing to do with GhostScript.If Ghostscript is supposed to create `document-tmp-2786319.384671.pdf` and fails, then Lilypond's `rename()` will naturally also fail, because `document-tmp-2786319.384671.pdf` does not exist. Therefore, even though the final error message originates from Lilypond, the primary source of the issue would be Ghostscript.
Ah yes, that's right judging from the --verbose log output I got at some point:Invoking `gs -dNODISPLAY -dNOSAFER -dNOPAUSE -dBATCH -dAutoRotatePages=/None -dPrinted=false /tmp/lilypond-tmp-2672114'... warning: g_spawn_sync failed (0): gs: Failed to close file descriptor for child process (Operation not permitted)
The invocation of GhostScript normally starts like this: GPL Ghostscript 9.56.1 (2022-04-04) Copyright (C) 2022 Artifex Software, Inc. All rights reserved. This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY: see the file COPYING for details. So it sounds like GhostScript doesn't even start. In any case, the GitHub people gave an answer, which is to use --security-opt seccomp=unconfined for the Docker container, in order to disable sandboxing. https://github.com/orgs/community/discussions/38510#discussioncomment-4081353 Therefore it is likely that the seccomp sandbox somehow disables something with subprocesses or the exact way LilyPond does them for GhostScript.
It would be neat if Lilypond could check the exit code of Ghostscript and fail earlier, but that seems difficult to do if you are sticking to ANSI C with its `system()` call that is quite oblivious to exit codes and the like.
As you can see from the error message, this call is using g_spawn_sync from GLib. Emitting a warning and not an error looks intentional to me. LilyPond tries to follow through in error conditions as much as it can. Best, Jean
OpenPGP_signature
Description: OpenPGP digital signature
