"Manifest generation failed" error in SBOM generation for all build legs

[ellahathaway]

The Generate SBoM Manifest step from the 1ES templates is failing all build legs (excluding the ones with guardian failures) with the following error:

##[error]Encountered an error while generating the manifest.
##[error]Error details: Access to the path '/mnt/vss/_work/1/s/artifacts/staging/_manifest' is denied.

This step is "succeeding with errors" so it's not failing the overall build. This occurs for 10.0 VMR, but it does not occur in builds of 9.0 and 8.0.

This is likely a regression caused by dotnet/sdk#45323

[ellahathaway]

cc @ViktorHofer - can you please TAL? I think this is a result of dotnet/sdk#45323

[ViktorHofer]

Thanks for the ping. I believe that the combination of dotnet/sdk#45407 & dotnet/sdk#44969 will fix this. Additionally, dotnet/sdk#45428 will clean this up.

[ViktorHofer]

I know this is fixed so I will pro-actively close the issue.

[Winniexu01]

Hi @ellahathaway @ViktorHofer , I reopened this issue because the offline legs are still failed with the same issue:

##[error]Encountered an error while generating the manifest.
##[error]Error details: Access to the path '/__w/1/a/artifacts/_manifest' is denied.

Example build (internal Microsoft link)

[ViktorHofer]

Hmm that doesn't make any sense to me. No idea what's going on here. cc @mmitche in case you have ideas

[ellahathaway]

Ah it's because it's an offline leg. When running offline builds, we do sudo unshare -n. This makes the files produced by the build only accessible by commands run with administrator privileges. sudo is necessary here to unshare the network, otherwise I'd suggest that we just remove it

[ViktorHofer]

I see, makes sense. Do you have a suggestion on how to handle this?

[ellahathaway]

Not sure. Maybe there's a way to copy to the files to a new location and direct the SBOM generation to look there? I'm not sure that that would change permissions of the files though.

[ViktorHofer]

If this is about ownership (sudo vs regular user), could we update the owner of the staging folder after the build?