permission denied when setting Icon compiling from Linux to Windows

[IvoryJam]

Describe the bug:

When setting the Icon to be used fyne-cross is throwing the following error

cp: cannot stat '/app/Icon.png': Permission denied

However when letting Fyne create Icon.png no error occurs.
My user is in the docker group and I've also set the custom Icon.png to be owned by my user and the docker group

➜ ~ groups
myUser wheel dialout docker libvirt

-rw-r--r--. 1 myUser docker 5575 Dec 12 23:11 custom_icon.png
-rw-r--r--. 1 myUser docker 2375 Dec 12 23:29 Icon.png

To Reproduce:

Steps to reproduce the behaviour:

1. Set custom Icon.png
2. Run fyne-cross windows -app-id=my.app.id
3. See error

Device and debug info (please complete the following information):

Device info

• OS: Linux
• Version: Fedora 39
• Go version: 1.21.4
• fyne-cross version: v1.4.0
• Fyne version: v2.4.2

Debug info

[i] Target: windows/amd64
&command.localContainerImage{baseContainerImage:command.baseContainerImage{arch:"amd64", os:"windows", id:"windows-amd64", env:map[string]string{"CC":"zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows", "CXX":"zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows", "GOARCH":"amd64", "GOOS":"windows"}, tags:[]string(nil), mount:[]command.containerMountPoint{command.containerMountPoint{name:"project", localHost:"/home/myUser/Documents/go/projectName", inContainer:"/app"}}, DockerImage:"docker.io/fyneio/fyne-cross-images:windows"}, runner:(*command.localContainerEngine)(0xc0000a0000)}
[i] Cleaning target directories...
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e GOOS=windows -e GOARCH=amd64 docker.io/fyneio/fyne-cross-images:windows rm -rf /app/fyne-cross/bin/windows-amd64
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e GOOS=windows -e GOARCH=amd64 -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows docker.io/fyneio/fyne-cross-images:windows mkdir -p /app/fyne-cross/bin/windows-amd64
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
[✓] "bin" dir cleaned: /app/fyne-cross/bin/windows-amd64
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e GOOS=windows -e GOARCH=amd64 -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows docker.io/fyneio/fyne-cross-images:windows rm -rf /app/fyne-cross/dist/windows-amd64
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e GOOS=windows -e GOARCH=amd64 -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows docker.io/fyneio/fyne-cross-images:windows mkdir -p /app/fyne-cross/dist/windows-amd64
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
[✓] "dist" dir cleaned: /app/fyne-cross/dist/windows-amd64
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e GOOS=windows -e GOARCH=amd64 -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows docker.io/fyneio/fyne-cross-images:windows rm -rf /app/fyne-cross/tmp/windows-amd64
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e GOOS=windows -e GOARCH=amd64 -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows docker.io/fyneio/fyne-cross-images:windows mkdir -p /app/fyne-cross/tmp/windows-amd64
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
[✓] "temp" dir cleaned: /app/fyne-cross/tmp/windows-amd64
[i] Checking for go.mod: /home/myUser/Documents/go/projectName/go.mod
[✓] go.mod found
/usr/bin/docker run --rm -t -w /app -v /home/myUser/Documents/go/projectName:/app:z --platform linux/amd64 -u 1000:1000 --entrypoint fixuid -v /run/user/1000/keyring/ssh:/tmp/ssh-agent -e SSH_AUTH_SOCK=/tmp/ssh-agent -e CGO_ENABLED=1 -e GOCACHE=/go/go-build -e CC=zig cc -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e CXX=zig c++ -target x86_64-windows-gnu -Wdeprecated-non-prototype -Wl,--subsystem,windows -e GOOS=windows -e GOARCH=amd64 docker.io/fyneio/fyne-cross-images:windows cp /app/Icon.png /app/fyne-cross/tmp/windows-amd64/Icon.png
fixuid: fixuid should only ever be used on development systems. DO NOT USE IN PRODUCTION
fixuid: runtime UID '1000' already matches container user 'docker' UID
fixuid: runtime GID '1000' already matches container group 'docker' GID
cp: cannot stat '/app/Icon.png': Permission denied
[✗] could not copy the icon to temp folder: exit status 1

[andydotxyz]

1. Set custom Icon.png

How are you doing this?

[IvoryJam]

I tried both by creating an "Icon.png" in the project folder and setting it with -icon custom_icon.png

[andydotxyz]

In the same directory as you are executing the fyne-cross command?

[IvoryJam]

Yes

[IvoryJam]

After doing some testing I've found some interesting info. If I already have Icon.png in the folder when I run fyne-cross the first time, everything works.

But when I introduce a brand new image downloaded off the internet and set that using -icon=whatever.png it breaks. If I rename whatever.png to Icon.png, it breaks.

Once it breaks, running fyne-cross on the project folder seems to not work unless I replace Icon.png with whatever it had to begin with. I've removed go.mod and go.sum and the fyne-cross folder, still breaks. Verified all the md5sum hashes and file and parent folder match the working directory, still broken. I've even gone so far as to chmod 777 the whole folder, still broken.

Is fyne-cross cacheing something somewhere that would cause this? This is a new one for me.

[Bluebugs]

I am wondering if by any chance you have some kind of security framework like selinux, maybe there could be some label on your file that won't even be affected by chmod. Just trying to figure out what could give that cache effect as fyne cross doesn't have any itself.

[julianboehne]

I am facing a quit similar failure. To implement a gitlab-ci release pipeline, I wanted to create a build pipeline with fyne cross and used different docker images as a base (e.g. golang-alpine, docker in docker or alpine). With each image I got the same error:

...
[✓] "temp" dir cleaned: /app/fyne-cross/tmp/windows-amd64
[i] Checking for go.mod: /builds/projects-internal/pws-client-golang-fyne/go.mod
[✓] go.mod found
cp: cannot stat '/app/Icon.png': No such file or directory
[✗] could not copy the icon to temp folder: exit status 1

I used the icon flag and also set my Icon as Icon.png in the root directory, but it sill crashes. It also crashes the same way if don't use any icon. I have Docker installed on every environment I have tested.
Are there any issue if I want to build my project using docker in docker?

[Bluebugs]

I definitively never tried to use docker in docker with fyne cross. There might be issue around the path and sharing files between the two container. Also what do you mean by using a different base image?

[IvoryJam]

Okay after testing I think I know what's going on with the cannot stat '/app/Icon.png': Permission denied

It happens if I run fyne-cross, download a new icon file (so it's creation time is after the first run), then run fyne-cross again.

It somehow just kills the ability to use that file, but if I do like a cp icon.png icon2.png then use icon2.png it works.

I've been able to reproduce it using this method multiple times.

[Bluebugs]

@IvoryJam thanks for spending the time to try to find a reproduction case. Are you by any chance in the same scenario @julianboehne ? Because with your explanation, I can see how docker in docker would not work. If the file are not replicated on the host system, but are only present inside the first layer of docker container, then when using docker in docker, the container created by fyne-cross who is bound to the host file system would not pick it up and things would not work. I don't think we can support docker in docker easily, will have to think about it.

The other possible explanation from your experiment, is there a chance otherwise that you have some secure linux policy or something like that in place that could make the right on your file impossible to be accessed by fyne-cross?

[julianboehne]

In my case it was a docker in docker issue as mentioned by @Bluebugs and I resolved it using a docker image and the dind service and set the flag -v /var/run/docker.sock:/var/run/docker.sock:

build_assets:
  stage: build
    image: docker:dind
    services:
        - name: docker:dind
          alias: docker
          command: ["--tls=false"]
  script:
    - docker run -t --rm --name application-name -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):$(pwd) -w $(pwd) golang:alpine3.19 /bin/ash -c "
	// install fyne cross dependencies ...
	...
	fyne-cross windows -pull -arch=amd64 -icon logo.png