Pyinstaller (in Wine) says it will stop working in 7.0 because of the administrator check

[sethrh]

I use pyinstaller (6.10.0) in wine to build .EXE's on linux via my gitlab CI/CD system. It works great ... and better, actually, than building natively on Windows (it seems to find dependencies better in wine).

Recently it has started shaming me for being not sensible, because it thinks I'm invoking it as administrator. I find it slightly amusing because it doesn't know the actual process is running with restricted privileges (and potentially in a container running in a virtual machine). But today I noticed rest of the message that says when 7.0 comes out, it will stop working if it detects administrator privileges. If true, that might mean my applications will no longer buildable in my CI/CD system (which would be less amusing).

So I'm wondering what can be done about it.

• Maybe this problem is specific to wine? As far as I know, wine (I'm on wine-8.0 from debian 12) always runs everything as administrator. (I don't run Windows anymore, but when I did, my user account was always an administrator account with UAC turned off. But it's been a few years, maybe people do it differently now.)

• I looked at the code and supposed that you could exclude wine (by checking for get_wine_version in ntdll.dll), but that's discouraged by wine, and doesn't seem like good idea anyway.

• This is a deprecation warning, will there be some way to override it and keep the old behavior?

[bwoodsend]

The warning message doesn't explain as much but the check is going out of its way to penalise only about regular users escalating to admin (the elevated half of a split token) and to avoid complaining about admin by default environments (full tokens) which should (and does on the setups I've tried) include wine.

I've installed wine into a Debian Docker container and I can confirm that it's reporting a split token. It even reports a split token if I install a non-root user into the Docker container then run wine as that non-root user. I think excluding wine is probably the best we can do here (we already have wine detection logic to handle not collecting wine's shim libraries). I don't want to provide an override because I know full well what it'll be used for...

[bwoodsend]

I've added the ignore wine check. Thanks for flagging this up.

[sethrh]

Perfect, thanks!

One of the forum posts I read suggested that newer versions of wine will start running as a non-administrator user, and elevate privileges when necessary (I can't find a link), so there may be additional excitement in the future.