[Bug]: Upgrade from 32.0.1 to 32.0.2 fails with "Check for write permissions"

[gav-]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Upgrade from 32.0.1 to 32.0.2 fails with "Check for write permissions" for "config.php,v" when using Nextcloud's web updater.

I use RCS to version my nextcloud/config/config.php file, Nextcloud has no reason to write to RCS/config.php,v (RCS's created file).

Steps to reproduce

1. Create an RCS directory under nextcloud/config/
2. Within nextcloud/config use RCS's ci -l config.php which creates an RCS/config.php,v file (note permissions on RCS/config.php,v do not include "writable")
3. Open Nextcloud's web updater and click "Start update"
4. "Check for write permissions" fails with the following text:

The following places can not be written to:

    config.php,v

Expected behavior

Update passes write permissions check for files not managed by Nextcloud.

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{                                                           
    "system": {                                             
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",              
            "***REMOVED SENSITIVE VALUE***"                                 
        ],                                                  
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",                                  
        "version": "32.0.1.2",     
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",   
        "dbtableprefix": "oc_",                             
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",      
        "installed": true,  
        "htaccess.RewriteBase": "\/",                       
        "mail_smtpmode": "smtp",                            
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",                                                           
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\Redis",          
        "memcache.locking": "\\OC\\Memcache\\Redis",        
        "redis": {     
            "host": "***REMOVED SENSITIVE VALUE***",        
            "port": 0,
            "dbindex": 0,
            "password": "***REMOVED SENSITIVE VALUE***",    
            "timeout": 1.5
        },                                                  
        "maintenance": false,                               
        "theme": "",   
        "loglevel": 2, 
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud.log",             
        "logfilemode": 416,
        "logdateformat": "F d, Y H:i:s",                    
        "enable_previews": true,                            
        "preview_max_x": 1920,        
        "preview_max_y": 1080,                              
        "enabledPreviewProviders": [                      
            "OC\\Preview\\PNG",                   
            "OC\\Preview\\JPEG",                
            "OC\\Preview\\GIF",   
            "OC\\Preview\\BMP",                  
            "OC\\Preview\\XBitmap",                         
            "OC\\Preview\\MP3",                             
            "OC\\Preview\\TXT",                       
            "OC\\Preview\\MarkDown",                        
            "OC\\Preview\\PDF",                             
            "OC\\Preview\\SVG",                             
            "OC\\Preview\\TIFF",                      
            "OC\\Preview\\Font",                        
            "OC\\Preview\\Movie"                  
        ],                  
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",                              
        "mysql.utf8mb4": true,                              
        "defaultapp": "apporder",                        
        "default_phone_region": "AU",                                                                                   
        "maintenance_window_start": 16,                     
        "app_install_overwrite": []
    }                                                       
}

List of activated Apps

Enabled:                                                    
  - activity: 5.0.0-dev.0
  - bookmarks: 16.0.1                                       
  - bruteforcesettings: 5.0.0-dev.0               
  - circles: 32.0.0                                         
  - cloud_federation_api: 1.16.0  
  - comments: 1.22.0                                        
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2         
  - deck: 1.16.1                                            
  - federatedfilesharing: 1.22.0     
  - federation: 1.22.0                                      
  - files: 2.4.0                                            
  - files_downloadlimit: 5.0.0-dev.0                        
  - files_external: 1.24.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0   
  - files_sharing: 1.24.0                                                                                               
  - files_trashbin: 1.22.0                                                                                              
  - files_versions: 1.25.0                                  
  - firstrunwizard: 5.0.0-dev.0                             
  - impersonate: 3.0.0    
  - logreader: 5.0.0-dev.0                                  
  - lookup_server_connector: 1.20.0          
  - metadata: 0.23.0      
  - notifications: 5.0.0-dev.0                              
  - oauth2: 1.20.0                                          
  - password_policy: 4.0.0-dev.0         
  - photos: 5.0.0-dev.1                                     
  - previewgenerator: 5.11.0                                                                                            
  - privacy: 4.0.0-dev.0                                    
  - profile: 1.1.0
  - provisioning_api: 1.22.0                                                                                            
  - related_resources: 3.0.0-dev.0                                                                                      
  - serverinfo: 4.0.0-dev.0                                 
  - settings: 1.15.1                                                                                                    
  - sharebymail: 1.22.0                                                                                                 
  - support: 4.0.0-dev.0                                    
  - systemtags: 1.22.0                                                                                                  
  - tasks: 0.17.1                                                                                                       
  - text: 6.0.1                                             
  - theming: 2.7.0                                          
  - twofactor_backupcodes: 1.21.0                        
  - updatenotification: 1.22.0                           
  - user_status: 1.12.0                                     
  - viewer: 5.0.0-dev.0                                     
  - weather_status: 1.12.0                                  
  - webhook_listeners: 1.3.0                                
  - workflowengine: 2.14.0
Disabled:                                                   
  - admin_audit: 1.22.0
  - app_api: 32.0.0 (installed 32.0.0)                      
  - encryption: 2.20.0   
  - nextcloud_announcements: 4.0.0-dev.0 (installed 1.4.0)  
  - recommendations: 5.0.0-dev.0 (installed 0.8.0)
  - survey_client: 4.0.0-dev.0 (installed 1.7.0)            
  - suspicious_login: 10.0.0-dev.0
  - twofactor_nextcloud_notification: 6.0.0-dev.0           
  - twofactor_totp: 14.0.0                                  
  - user_ldap: 1.23.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

From updater.log:

2025-11-21T10:35:12+1100 nEHWevIAdp [info] getChangelogURL()
2025-11-21T10:35:12+1100 nEHWevIAdp [info] end of checkForUpdate() Update to Nextcloud 32.0.2 available. (channel: "stable")<br /><span class="light">Following file will be downloaded automatically:</span> <code class="light">https://download.nextcloud.com/server/releases/nextcloud-32.0.2.zip</code><br /><a class="external_link" href="https://nextcloud.com/changelog/#32-0-2" target="_blank" rel="noreferrer noopener">Open changelog ↗</a>
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] request to updater
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] currentStep()
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] POST request for step "1"
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] startStep("1")
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] checkForExpectedFilesAndFolders()
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] end of checkForExpectedFilesAndFolders()
2025-11-21T10:35:32+1100 DNRyyTAD3o [info] endStep("1")
2025-11-21T10:35:32+1100 6oU8xxfS0m [info] request to updater
2025-11-21T10:35:32+1100 6oU8xxfS0m [info] currentStep()
2025-11-21T10:35:32+1100 6oU8xxfS0m [info] Step 1 is in state "end".
2025-11-21T10:35:32+1100 6oU8xxfS0m [info] POST request for step "2"
2025-11-21T10:35:33+1100 6oU8xxfS0m [info] startStep("2")
2025-11-21T10:35:33+1100 6oU8xxfS0m [info] checkWritePermissions()
2025-11-21T10:35:33+1100 6oU8xxfS0m [error] POST request failed with UpdateException
2025-11-21T10:35:33+1100 6oU8xxfS0m [error] Exception: UpdateException
Message: 
Code:0
Trace:
#0 /var/www/html/nextcloud/updater/index.php(1421): Updater->checkWritePermissions()
nextcloud/server#1 {main}
File:/var/www/html/nextcloud/updater/index.php
Line:398
Data:
Array
(
    [0] => config.php,v
)

Additional info

No response

[MrRinkana]

Aren't write permissions to config.php mandatory? Nextcloud sometimes has to write things there, such as setting "maintenance mode: true" during updates, no?

[gav-]

Aren't write permissions to config.php mandatory? Nextcloud sometimes has to write things there, such as setting "maintenance mode: true" during updates, no?

You clearly haven't read my bug report, and I am forced to reply in case someone is now misled by your comment.

I explicitly stated that the file in question is config.php,v. It is not a file that Nextcloud has any reason to modify. It is an artifact from using RCS for version control.

[joshtrichards]

Update passes write permissions check for files not managed by Nextcloud.

All files in the installation folder are managed by Nextcloud.

The error message is from the built-in automated Updater app and matches implementation. Write permission is required for it to be able to reliably move around and update the installation folder contents:

https://docs.nextcloud.com/server/latest/admin_manual/maintenance/update.html#what-does-the-updater-do

If that's a problem you can use an alternative update method, such as the manual upgrade process (also documented in the Admin Manual).

[vlastimilott]

Trying to update from 32.0.0 to 32.0.2, this is from updater.log. The CLI updater stops with the same failure.

2025-11-29T10:45:01+0000 qUpDrQoRIj [info] checkForUpdate() Array
(
    [version] => 32.0.2.2
    [versionstring] => Nextcloud 32.0.2
    [url] => https://download.nextcloud.com/server/releases/nextcloud-32.0.2.zip
    [downloads] => SimpleXMLElement Object
        (
            [bz2] => Array
                (
                    [0] => https://github.com/nextcloud-releases/server/releases/download/v32.0.2/nextcloud-32.0.2.tar.bz2
                    [1] => https://download.nextcloud.com/server/releases/nextcloud-32.0.2.tar.bz2
                )

            [zip] => Array
                (
                    [0] => https://github.com/nextcloud-releases/server/releases/download/v32.0.2/nextcloud-32.0.2.zip
                    [1] => https://download.nextcloud.com/server/releases/nextcloud-32.0.2.zip
                )

        )

    [web] => https://docs.nextcloud.com/server/32/admin_manual/maintenance/upgrade.html
    [changes] => https://updates.nextcloud.com/changelog_server/?version=32.0.2
    [autoupdater] => 1
    [eol] => 0
    [eolDate] => SimpleXMLElement Object
        (
        )

    [signature] => xnW+k/9eIZF5fV87I1kgXQjhPgnP/LW6K8AZ3bep/MJfrDILNtvZCyUAZyR3NjMk
1S6AdZTTYgyRkGqtidi8q5lfsq1wzGxLUZRXNzAqIcYDPrMtPctPW7unhNGEeVsp
XwLonGtJrELEd3kGQX358Qg+ZhmAB6s0Jykt+zjZLmFOi/vZoru2lWtx1hqYDXva
Si4d80+47GGKEq0J9hm3ZXT7YdoMNEBx08vf5oCoebtfyKtqIGROstFl9jkp1Gu/
36+hTTiiicGS8oofCdc2Vt9i7ap59XSexI1Dy3oBnpHZFi/Wi7xUJQ4EZCNksGwT
nhE2PTn9tybRi3nFnpwyRg==
)
2025-11-29T10:45:01+0000 qUpDrQoRIj [info] getChangelogURL()
2025-11-29T10:45:01+0000 qUpDrQoRIj [info] end of checkForUpdate() Update to Nextcloud 32.0.2 available. (channel: "stable")<br /><span class="light">Following file will be downloaded automatically:</span> <code class="light">https://download.nextcloud.com/server/releases/nextcloud-32.0.2.zip</code><br /><a class="external_link" href="https://nextcloud.com/changelog/#32-0-2" target="_blank" rel="noreferrer noopener">Open changelog ↗</a>
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] updater started
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] executeStep request for step "1"
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] startStep("1")
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] checkForExpectedFilesAndFolders()
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] end of checkForExpectedFilesAndFolders()
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] endStep("1")
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] executeStep request for step "2"
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] startStep("2")
2025-11-29T10:45:08+0000 qUpDrQoRIj [info] checkWritePermissions()
2025-11-29T10:45:10+0000 qUpDrQoRIj [error] executeStep request failed with UpdateException
2025-11-29T10:45:10+0000 qUpDrQoRIj [error] Exception: NC\Updater\UpdateException
Message: 
Code:0
Trace:
#0 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/lib/UpdateCommand.php(399): NC\Updater\Updater->checkWritePermissions()
#1 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/lib/UpdateCommand.php(232): NC\Updater\UpdateCommand->executeStep()
#2 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/vendor/symfony/console/Command/Command.php(298): NC\Updater\UpdateCommand->execute()
#3 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/vendor/symfony/console/Application.php(1040): Symfony\Component\Console\Command\Command->run()
#4 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/vendor/symfony/console/Application.php(301): Symfony\Component\Console\Application->doRunCommand()
#5 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/vendor/symfony/console/Application.php(171): Symfony\Component\Console\Application->doRun()
#6 phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/updater.php(17): Symfony\Component\Console\Application->run()
#7 /var/www/xxxxxxxx.xx/team/updater/updater.phar(14): require('...')
#8 {main}
File:phar:///var/www/xxxxxxxx.xx/team/updater/updater.phar/lib/Updater.php
Line:380
Data:
Array
(
    [0] => pack-9f4b83a0ac5de685cc5f58e97f9431b174d8d3a5.pack
    [1] => pack-9f4b83a0ac5de685cc5f58e97f9431b174d8d3a5.idx
)


2025-11-29T10:45:10+0000 qUpDrQoRIj [info] rollbackChanges("2")
2025-11-29T10:45:10+0000 qUpDrQoRIj [info] unlink .step
2025-11-29T10:45:10+0000 qUpDrQoRIj [info] end of  rollbackChanges()

CLI:

[✔] Check for expected files
[✘] Check for write permissions failed
The following places can not be written to:
    pack-9f4b83a0ac5de685cc5f58e97f9431b174d8d3a5.pack
    pack-9f4b83a0ac5de685cc5f58e97f9431b174d8d3a5.idx

Update failed. To resume or retry just execute the updater again.

[tbart]

Seeing the same, this is not a dev setup, the .git files are from 2020, could be some leftover artifact from earlier installations that included this though they should not have.

I had a hard time finding out, where exactly those files are (NC generally often spits out errors regarding filenames and not full paths).

I hacked public function checkWritePermissions() in Updater.php:

--- updater/lib/Updater.php.org 2025-11-29 20:16:49.399486527 +0100
+++ updater/lib/Updater.php	2025-11-29 19:59:55.648912637 +0100
@@ -374,7 +374,7 @@
 	        $notWritablePaths = [];
 	        foreach ($this->getRecursiveDirectoryIterator($this->nextcloudDir, $excludedElements) as $path => $fileInfo) {
 		                if (!$fileInfo->isWritable()) {
-                $notWritablePaths[] = $fileInfo->getFilename();
+                $notWritablePaths[] = $fileInfo->getRealPath();
 		                }
 	        }
 	        if (count($notWritablePaths) > 0) {

That improves things a lot, as you then get

Info: Pressing Ctrl-C will finish the currently running step and then stops the updater.

[✔] Check for expected files
[✘] Check for write permissions failed
The following places can not be written to:
    /var/www/nextcloud/apps/gallery/.git/objects/pack/pack-25d93babd2eb7b7c4255035ffafb9b3a73f5e1dd.idx
    /var/www/nextcloud/apps/gallery/.git/objects/pack/pack-25d93babd2eb7b7c4255035ffafb9b3a73f5e1dd.pack

Update failed. To resume or retry just execute the updater again.

After giving the owner write permissions to these files, the update succeeds.

Please always output full paths when detecting permission/file access errors, all over Nextcloud (server, updater, etc.)!

[kslen]

Seeing the same, and full path in logs is seconded.

Current version is 32.0.0.

Update to Nextcloud 32.0.2 available. (channel: "stable")
Following file will be downloaded automatically: https://download.nextcloud.com/server/releases/nextcloud-32.0.2.zip
Open changelog ↗

Updater run in non-interactive mode.

Start update

Info: Pressing Ctrl-C will finish the currently running step and then stops the updater.

[✔] Check for expected files
[✘] Check for write permissions failed
The following places can not be written to:
    ctstring_internal.h
    ctstring.h
    trt_convert_api.h
    tf_attrtype.h
    tf_datatype.h
    c_api_macros.h
    tf_file_statistics.h
    tf_status.h
    tf_tstring.h
    c_api.h
    tensor_interface.h
    dlpack.h
    c_api.h
    c_api_experimental.h
    tf_tensor.h
    c_api_experimental.h
    LICENSE
    THIRD_PARTY_TF_C_LICENSES
    libtensorflow_framework.so.2
    libtensorflow.so.2.9.1
    libtensorflow.so
    libtensorflow.so.2
    libtensorflow_framework.so.2.9.1
    libtensorflow_framework.so
    ctstring_internal.h
    ctstring.h
    tf_attrtype.h
    tf_datatype.h
    c_api_macros.h
    tf_file_statistics.h
    tf_status.h
    tf_tstring.h
    c_api.h
    tensor_interface.h
    dlpack.h
    c_api.h
    c_api_experimental.h
    tf_tensor.h
    c_api_experimental.h
    LICENSE
    THIRD_PARTY_TF_C_LICENSES
    libtensorflow_framework.so.2
    libtensorflow.so.2.9.1
    libtensorflow.so
    libtensorflow.so.2
    libtensorflow_framework.so.2.9.1
    libtensorflow_framework.so

Update failed. To resume or retry just execute the updater again.

As I figured ok, let's update those apps that are out of date, and find that the "Upgrade all" button throws an error, but updating them one by one worked without issue.

Before starting the process of tracking down these files, I decided to give the web-based updater another shot, which failed during the download phase and the retry button on the updater page did not work. However, the server was still running fine, so I returned to the admin panel, clicked Open Updater and gave it a final shot - and the update to 32.0.2 went through with no issues.

I'm a bit pressed for time, so please excuse me for not including logs pertaining to the update process. If at all useful at this stage, I'll try to get back to you with the logs as soon as I can.