Meson packaged with pyinstaller>=6.22.1: Security validation failure: parent process has different executable!

[andrei-pavel]

Describe the bug

meson compile results in an error at the first link step when Meson is packaged with Pyinstaller 6.22.1 or later. Here is an excerpt of the output:

14:03:46  FAILED: [code=255] src/lib/exceptions/libkea-exceptions.so.55.0.0.p/libkea-exceptions.so.55.0.0.symbols 
14:03:46  /usr/local/bin/meson --internal symbolextractor /tmp/kea/build src/lib/exceptions/libkea-exceptions.so.55.0.0 src/lib/exceptions/libkea-exceptions.so.55.0.0 src/lib/exceptions/libkea-exceptions.so.55.0.0.p/libkea-exceptions.so.55.0.0.symbols 
14:03:46  [PYI-4507:ERROR] Security validation failure: parent process has different executable!

To Reproduce

In the interest of time, could I ask that you use our script that already does the packaging and runs Meson? Here are the steps:

git checkout https://gitlab.isc.org/isc-projects/kea.git
cd kea
git checkout Kea-3.3.0  # Just to be sure it can be replicated, because we may have already merged the pinning of the pyinstaller version in the meantime.
./meson.sh setup build  # If you don't have Meson already installed, it will package Meson in a local directory called `.meson` and run it from there on any subsequent invocation of meson.sh.
./meson.sh compile -C build  # Error appears.

If you have Meson already installed, and you don't want to uninstall it, you can bypass the check in meson.sh with the following patch:

diff --git a/meson.sh b/meson.sh
index 5ab22e0af3..169dbf21c4 100755
--- a/meson.sh
+++ b/meson.sh
@@ -66,3 +66,3 @@ cd "${top_level}" || exit 1
 
-if command -v meson > /dev/null 2>&1 && ! "${latest}" && le "${meson_version}" "$(meson --version)"; then
+if false && command -v meson > /dev/null 2>&1 && ! "${latest}" && le "${meson_version}" "$(meson --version)"; then
     # Good to be used. Does not suffer from endless transitional dependency iteration fixed in 1.8.0.

Expected behavior
I would have expected that the compilation succeeds.

system parameters

• Plain native build
• Arch Linux by the way
• Python 3.14.7
• Meson verison 1.10.0 or 1.12.0 are what I tested.
• Ninja 1.13.2

[eli-schwartz]

This "security validation" appears to be a brand new PyInstaller "feature": pyinstaller/pyinstaller#9492

There is known breakage in that brand new 6.22.1 release, although it was reported only against Windows, not Linux.

Given that the issue is tied to a PyInstaller upgrade, it is likely this is PyInstaller's fault and that there are additional bugs in the new feature. Please report it upstream and we can follow up on it here if upstream says we're doing something wrong.

[bonzini]

PyInstaller 6.22.1 (pyinstaller/pyinstaller#9492) implemented additional security validation for onefile processes. When the process inherits the environment variables (presumably from a onefile parent process), it checks that the executable of the parent process matches its own executable.

Probably this is because we go meson compile -> ninja -> meson --internal symbolextractor. The workaround for this specific use is to avoid meson compile, but that doesn't prevent other recursions like meson setup -> (user-provided script) -> meson introspect (via $MESONINTROSPECT).

I don't know if meson can be changed to block the environment variables, but for now the only solution is not to use 6.22.0.

[eli-schwartz]

Waiiiiiiit, so it doesn't bother to walk the tree to find the originating PyInstaller process? That sounds buggy.

[bonzini]

Well the worry is that intermediate processes can make the child do bad things, so that's by design. Bad, but by design.