Add support for protected conda environments

constructor/header.sh

@@ -591,6 +591,7 @@ shortcuts=""
 
 {%- set channels = final_channels|join(",") %}
 # shellcheck disable=SC2086
+CONDA_PROTECT_FROZEN_ENVS="0" \
 CONDA_ROOT_PREFIX="$PREFIX" \
 CONDA_REGISTER_ENVS="{{ register_envs }}" \
 CONDA_SAFETY_CHECKS=disabled \
@@ -631,6 +632,7 @@ for env_pkgs in "${PREFIX}"/pkgs/envs/*/; do
     env_shortcuts=""
     {%- endif %}
     # shellcheck disable=SC2086
+    CONDA_PROTECT_FROZEN_ENVS="0" \
     CONDA_ROOT_PREFIX="$PREFIX" \
     CONDA_REGISTER_ENVS="{{ register_envs }}" \
     CONDA_SAFETY_CHECKS=disabled \

constructor/main.py

@@ -122,6 +122,12 @@ def main_build(
     ):
         sys.exit("Error: uninstalling with conda.exe requires conda-standalone 24.11.0 or newer.")
 
+    if (info.get("CONDA_PROTECT_FROZEN_ENVS")
+        and exe_type == StandaloneExe.CONDA
+        and exe_version
+        and exe_version <= Version("25.5.1")):
+        sys.exit("Error: installing with protected base environment requires conda-standalone newer than 25.5.1.")
+
     logger.debug("conda packages download: %s", info["_download_dir"])
 
     for key in ("welcome_image_text", "header_image_text"):

constructor/nsis/main.nsi.tmpl

@@ -1296,11 +1296,12 @@ Section "Install"
 {%- endfor %}
     System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_SAFETY_CHECKS", "disabled").r0'
     System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_EXTRA_SAFETY_CHECKS", "no").r0'
-    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_ROOT_PREFIX", "$INSTDIR")".r0'
-    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_PKGS_DIRS", "$INSTDIR\pkgs")".r0'
+    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_ROOT_PREFIX", "$INSTDIR").r0'
+    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_PKGS_DIRS", "$INSTDIR\pkgs").r0'
+    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_PROTECT_FROZEN_ENVS", "0").r0'
     # Spinners in conda write a new character with each movement of the spinner.
     # For long installation times, this may cause a buffer overflow, crashing the installer.
-    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_QUIET", "1")".r0'
+    System::Call 'kernel32::SetEnvironmentVariable(t,t)i("CONDA_QUIET", "1").r0'
     # Extra info for pre and post install scripts
     # NOTE: If more vars are added, make sure to update the examples/scripts tests too
     #       There's a similar block for the pre_uninstall script, further down this file.

constructor/osx/run_installation.sh

@@ -47,6 +47,7 @@ fi
 notify "Installing packages. This might take a few minutes."
 # shellcheck disable=SC2086
 if ! \
+CONDA_PROTECT_FROZEN_ENVS="0" \
 CONDA_REGISTER_ENVS="{{ register_envs }}" \
 CONDA_ROOT_PREFIX="$PREFIX" \
 CONDA_SAFETY_CHECKS=disabled \
@@ -93,6 +94,7 @@ for env_pkgs in "${PREFIX}"/pkgs/envs/*/; do
     fi
 
     # shellcheck disable=SC2086
+    CONDA_PROTECT_FROZEN_ENVS="0" \
     CONDA_ROOT_PREFIX="$PREFIX" \
     CONDA_REGISTER_ENVS="{{ register_envs }}" \
     CONDA_SAFETY_CHECKS=disabled \

examples/protected_base/conda-meta/frozen

@@ -0,0 +1 @@
+# This environment is protected.

examples/protected_base/construct.yaml

@@ -0,0 +1,22 @@
+# yaml-language-server: $schema=../../constructor/data/construct.schema.json
+"$schema": "../../constructor/data/construct.schema.json"
+
+name: ProtectedBaseEnv
+version: X
+installer_type: all
+
+channels:
+  - defaults
+
+specs:
+  - python
+  - conda
+
+extra_envs:
+  default:
+    specs:
+      - python
+      - pip
+
+extra_files:
+  - frozen.json: conda-meta/frozen

tests/test_examples.py

@@ -1370,3 +1370,18 @@ def test_regressions(tmp_path, request):
             check_subprocess=True,
             uninstall=True,
         )
+
+def test_frozen_environment(tmp_path, request):
+    input_path = _example_path("protected_base")
+    for installer, install_dir in create_installer(input_path, tmp_path):
+        frozen_file = install_dir / "conda-meta" / "frozen"
+        assert frozen_file.exists()
+        _run_installer(
+            input_path,
+            installer,
+            install_dir,
+            request=request,
+            check_subprocess=True,
+            uninstall=True
+        )
+        assert frozen_file.exists()