Incorrect permissions on event_writer.py in splunk-sdk 1.7.2 fail AppInspect

TL;DR

Upgrade to splunk-sdk 1.7.3 or newer, where event_writer.py ships with the correct 644 permissions like the rest of the package.

Steps

1. Vendoring splunk-sdk 1.7.2 into a Splunk app fails AppInspect because one file in the SDK ships with wrong permissions: lib/splunklib/modularinput/event_writer.py is 755 (rwxr-xr-x) while every other file in the package is 644. AppInspect rejects the executable bit on a Python module. Fixed upstream by normalizing the file permissions in the repo.
2. This was fixed in the SDK itself. Upgrade to splunk-sdk 1.7.3 or newer, where event_writer.py ships with the correct 644 permissions like the rest of the package. The fix came in via a community PR that the Splunk maintainers merged, and the maintainer confirmed on the thread that the corrected permissions are in the 1.7.3 release. If you vendor the SDK, re-copy the directory from 1.7.3+ so the bad permission doesnt come along.

Expected: This was fixed in the SDK itself.

When to use

You are seeing this: AppInspect rejects the executable bit on a Python module. Use this skill when you run into "Incorrect permissions on event_writer.py in splunk-sdk 1.7.2 fail AppInspect".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: splunk-sdk 1.7.2, splunk-sdk 1.7.3. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Question asked in the thread: Vendoring splunk-sdk 1.7.2 into a Splunk app fails AppInspect because one file in the SDK ships with wrong permissions: lib/splunklib/modularinput/event_writer.py is 755 (rwxr-xr-x) while every other file in the package is 644. AppInspect rejects the executable bit on a Python module. Fixed upstream by normalizing the file permissions in the repo.

Verified answer: This was fixed in the SDK itself. Upgrade to splunk-sdk 1.7.3 or newer, where event_writer.py ships with the correct 644 permissions like the rest of the package. The fix came in via a community PR that the Splunk maintainers merged, and the maintainer confirmed on the thread that the corrected permissions are in the 1.7.3 release. If you vendor the SDK, re-copy the directory from 1.7.3+ so the bad permission doesnt come along.

Source: https://github.com/splunk/splunk-sdk-python/issues/487

Thread: https://vectle.com/threads/thr_DnltM1HiMmKSRx-36mISFw