From f965b5799a8ca5832472ef4d172e111ca924a592 Mon Sep 17 00:00:00 2001
From: Arm Patinyasakdikul <arm.patinyasakdikul@amd.com>
Date: Wed, 13 May 2026 13:43:12 -0500
Subject: [PATCH 1/6] ci: fix package versioning across DEB/RPM/TGZ builds

Two issues surfaced from run 25393634415 on release/test_artifact:

1. manylinux container falls back to TRANSFERBENCH_VERSION_PATCH="02"
   because git's "dubious ownership" guard rejects the host-UID-owned
   workspace when the container runs as root. Same commit produced
   1.66.11 on Ubuntu and 1.66.02 on manylinux. Mark the repo safe for
   the container's root user before CMake's git probe runs.

2. CPack writes <name>-<version>-Linux.{deb,rpm,tar.gz}, omitting the
   release tag. Successive release/* runs overwrite each other in S3
   and the run number is invisible from the filename. Switch DEB/RPM
   to canonical CPack filenames (which embed release + arch) and
   thread the release tag into CPACK_ARCHIVE_FILE_NAME for the TGZ.
---
 CMakeLists.txt          | 21 +++++++++++++++++++--
 build_packages_local.sh |  8 ++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 23eb07a..1cc6f1f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -331,6 +331,15 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "TransferBench: benchmark simultaneous transfers between CPU/GPU/NIC")
   set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/LICENSE.md")
 
+  # Resolve the per-build release tag (set by build_packages_local.sh via env)
+  # so it can be threaded into both DEB/RPM metadata AND the TGZ filename.
+  set(_tb_pkg_release "")
+  if(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
+    set(_tb_pkg_release "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
+  elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
+    set(_tb_pkg_release "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
+  endif()
+
   # DEB
   set(CPACK_DEBIAN_PACKAGE_NAME       "${CPACK_PACKAGE_NAME}")
   set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
@@ -339,6 +348,8 @@ if(BUILD_RELOCATABLE_PACKAGE)
   if(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
     set(CPACK_DEBIAN_PACKAGE_RELEASE "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
+  # Canonical filename: <name>_<version>-<release>_<arch>.deb
+  set(CPACK_DEBIAN_FILE_NAME "DEB-DEFAULT")
 
   # RPM
   set(CPACK_RPM_PACKAGE_NAME    "${CPACK_PACKAGE_NAME}")
@@ -348,6 +359,8 @@ if(BUILD_RELOCATABLE_PACKAGE)
   if(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
     set(CPACK_RPM_PACKAGE_RELEASE "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
   endif()
+  # Canonical filename: <name>-<version>-<release>.<arch>.rpm
+  set(CPACK_RPM_FILE_NAME "RPM-DEFAULT")
   # Use the actual install prefix (caller-controlled in relocatable mode)
   # rather than hard-coded /opt/... paths.
   if(DEFINED CPACK_PACKAGING_INSTALL_PREFIX)
@@ -360,8 +373,12 @@ if(BUILD_RELOCATABLE_PACKAGE)
         "${_rpm_exclude_prefix}"
         "${_rpm_exclude_prefix}/bin")
 
-  # TGZ
-  set(CPACK_ARCHIVE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
+  # TGZ — embed release tag so successive runs do not collide on the same key.
+  if(_tb_pkg_release STREQUAL "")
+    set(CPACK_ARCHIVE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
+  else()
+    set(CPACK_ARCHIVE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${_tb_pkg_release}-Linux")
+  endif()
 
   set(CPACK_GENERATOR "DEB;RPM;TGZ")
   include(CPack)
diff --git a/build_packages_local.sh b/build_packages_local.sh
index cf12b83..b086c65 100755
--- a/build_packages_local.sh
+++ b/build_packages_local.sh
@@ -40,6 +40,14 @@ BUILD_DIR="${REPO_ROOT}/build"
 SDK_DIR="${HOME}/rocm-sdk"
 ROCM_PATH="${SDK_DIR}/install"
 
+# Containerized builds (e.g. manylinux on a host-mounted workspace) hit git's
+# "dubious ownership" guard because the checkout is host-UID-owned but we run
+# as root. Without this, `git describe` in CMakeLists.txt silently fails and
+# TRANSFERBENCH_VERSION_PATCH falls back to its hard-coded default.
+if command -v git >/dev/null 2>&1; then
+  git config --global --add safe.directory "${REPO_ROOT}" || true
+fi
+
 # Default GPU targets baked into every package, regardless of GPU_FAMILY tarball.
 DEFAULT_GPU_TARGETS="gfx906;gfx908;gfx90a;gfx942;gfx950;gfx1030;gfx1100;gfx1101;gfx1102;gfx1150;gfx1151;gfx1200;gfx1201"
 GPU_TARGETS="${GPU_TARGETS:-$DEFAULT_GPU_TARGETS}"

From 98588f3b5e19d23180ae000c3f6faccbc35452df Mon Sep 17 00:00:00 2001
From: Arm Patinyasakdikul <arm.patinyasakdikul@amd.com>
Date: Wed, 13 May 2026 13:58:03 -0500
Subject: [PATCH 2/6] ci: pass package release as -D arg, not just env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Run 25819267330 confirmed the version-sync fix works (both jobs report
1.66.13) and that DEB/RPM filenames now embed the release. But the
Ubuntu TGZ filename still came out as `…-1.66.13-Linux.tar.gz` — no
release tag — while manylinux's TGZ embedded it correctly.

Root cause: CMakeLists derived the release tag from
`ENV{CPACK_RPM_PACKAGE_RELEASE}` at configure time. Ubuntu invokes the
script via `sudo -E …`, and although the script then `export`s those
env vars, they don't reliably reach CMake's environment on the sudo
path. The DEB filename still worked because `DEB-DEFAULT` is processed
by CPack at package time, not configure time, so the env var
propagated to the `cpack -G DEB` child directly.

Fix: pass `PKG_RELEASE` as `-DTRANSFERBENCH_PACKAGE_RELEASE=…` from
the build script. CMake reads it directly from the cache, bypassing
env propagation entirely. Env-var fallbacks remain so direct cmake
invocations (without the wrapper script) keep working.
---
 CMakeLists.txt          | 19 +++++++++++++------
 build_packages_local.sh |  1 +
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1cc6f1f..b645df8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -331,12 +331,15 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "TransferBench: benchmark simultaneous transfers between CPU/GPU/NIC")
   set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_CURRENT_SOURCE_DIR}/LICENSE.md")
 
-  # Resolve the per-build release tag (set by build_packages_local.sh via env)
-  # so it can be threaded into both DEB/RPM metadata AND the TGZ filename.
+  # Per-build release tag, threaded into DEB/RPM metadata AND the TGZ filename.
+  # Prefer the explicit -D from build_packages_local.sh; fall back to the env
+  # vars CPack itself reads (so direct cmake invocations still work).
   set(_tb_pkg_release "")
-  if(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
+  if(DEFINED TRANSFERBENCH_PACKAGE_RELEASE AND NOT TRANSFERBENCH_PACKAGE_RELEASE STREQUAL "")
+    set(_tb_pkg_release "${TRANSFERBENCH_PACKAGE_RELEASE}")
+  elseif(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE} AND NOT "$ENV{CPACK_RPM_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
-  elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
+  elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE} AND NOT "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
 
@@ -345,7 +348,9 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
   set(CPACK_DEBIAN_PACKAGE_DEPENDS    "numactl, libnuma1, hsa-rocr")
   set(CPACK_DEBIAN_PACKAGE_MAINTAINER "${CPACK_PACKAGE_CONTACT}")
-  if(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
+  if(NOT _tb_pkg_release STREQUAL "")
+    set(CPACK_DEBIAN_PACKAGE_RELEASE "${_tb_pkg_release}")
+  elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
     set(CPACK_DEBIAN_PACKAGE_RELEASE "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
   # Canonical filename: <name>_<version>-<release>_<arch>.deb
@@ -356,7 +361,9 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_RPM_PACKAGE_LICENSE "MIT")
   set(CPACK_RPM_PACKAGE_REQUIRES "numactl, hsa-rocr")
   set(CPACK_RPM_PACKAGE_VENDOR  "${CPACK_PACKAGE_VENDOR}")
-  if(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
+  if(NOT _tb_pkg_release STREQUAL "")
+    set(CPACK_RPM_PACKAGE_RELEASE "${_tb_pkg_release}")
+  elseif(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
     set(CPACK_RPM_PACKAGE_RELEASE "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
   endif()
   # Canonical filename: <name>-<version>-<release>.<arch>.rpm
diff --git a/build_packages_local.sh b/build_packages_local.sh
index b086c65..c510a63 100755
--- a/build_packages_local.sh
+++ b/build_packages_local.sh
@@ -228,6 +228,7 @@ CMAKE_ARGS=(
   -DENABLE_MPI_COMM=OFF
   -DDISABLE_DMABUF=OFF
   -DGPU_TARGETS="${GPU_TARGETS}"
+  -DTRANSFERBENCH_PACKAGE_RELEASE="${PKG_RELEASE}"
 )
 if [[ -n "${CMAKE_CXX_COMPILER_OVERRIDE}" ]]; then
   CMAKE_ARGS+=(-DCMAKE_CXX_COMPILER="${CMAKE_CXX_COMPILER_OVERRIDE}")

From e5dc5d3e6f620919a57112d86bf2d4a6014dd5d7 Mon Sep 17 00:00:00 2001
From: Arm Patinyasakdikul <arm.patinyasakdikul@amd.com>
Date: Wed, 13 May 2026 14:34:44 -0500
Subject: [PATCH 3/6] ci: temporary debug print to diagnose Ubuntu TGZ
 release-tag miss

---
 CMakeLists.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index b645df8..395e4b7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -342,6 +342,10 @@ if(BUILD_RELOCATABLE_PACKAGE)
   elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE} AND NOT "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
+  message(STATUS "TB_DEBUG resolved _tb_pkg_release=[${_tb_pkg_release}]")
+  message(STATUS "TB_DEBUG TRANSFERBENCH_PACKAGE_RELEASE=[${TRANSFERBENCH_PACKAGE_RELEASE}] defined=[${TRANSFERBENCH_PACKAGE_RELEASE-UNDEF}]")
+  message(STATUS "TB_DEBUG ENV CPACK_RPM_PACKAGE_RELEASE=[$ENV{CPACK_RPM_PACKAGE_RELEASE}]")
+  message(STATUS "TB_DEBUG ENV CPACK_DEBIAN_PACKAGE_RELEASE=[$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}]")
 
   # DEB
   set(CPACK_DEBIAN_PACKAGE_NAME       "${CPACK_PACKAGE_NAME}")

From 541622a37a33798ae11de3ac8680b5fb3c723be5 Mon Sep 17 00:00:00 2001
From: Arm Patinyasakdikul <arm.patinyasakdikul@amd.com>
Date: Wed, 13 May 2026 15:20:35 -0500
Subject: [PATCH 4/6] ci: dump CPackConfig.cmake archive name to diagnose
 Ubuntu TGZ

---
 build_packages_local.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/build_packages_local.sh b/build_packages_local.sh
index c510a63..bd61ac1 100755
--- a/build_packages_local.sh
+++ b/build_packages_local.sh
@@ -237,6 +237,10 @@ fi
 "${CMAKE_BIN}" "${CMAKE_ARGS[@]}"
 ok "CMake configured"
 
+echo "===== TB_DEBUG dump of CPACK_*_FILE_NAME from CPackConfig.cmake ====="
+grep -nE "CPACK_(ARCHIVE|PACKAGE|DEBIAN|RPM)_FILE_NAME|CPACK_(DEBIAN|RPM)_PACKAGE_RELEASE|TRANSFERBENCH_PACKAGE_RELEASE" "${BUILD_DIR}/CPackConfig.cmake" || true
+echo "===== END TB_DEBUG ====="
+
 # -------- build --------
 log "Building TransferBench (-j$(nproc))..."
 "${CMAKE_BIN}" --build "${BUILD_DIR}" -- -j"$(nproc)"

From 08db921a597fd4142dfc7c4b724a524e15c6ab33 Mon Sep 17 00:00:00 2001
From: Arm Patinyasakdikul <arm.patinyasakdikul@amd.com>
Date: Wed, 13 May 2026 15:39:40 -0500
Subject: [PATCH 5/6] ci: also set CPACK_PACKAGE_FILE_NAME for TGZ on older
 CMake
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CMake 3.26 (manylinux container) honors CPACK_ARCHIVE_FILE_NAME for
the TGZ generator. CMake 3.22 (Ubuntu 22.04 system cmake) falls back
to CPACK_PACKAGE_FILE_NAME instead, ignoring my ARCHIVE_FILE_NAME
override. Diagnostic dump confirmed both jobs wrote identical
CPackConfig.cmake — the divergence is purely in cpack runtime
behavior between the two CMake versions.

Set both to the same suffixed value. DEB/RPM are unaffected because
they use the explicit DEB-DEFAULT / RPM-DEFAULT canonical-naming
tokens, which take precedence over CPACK_PACKAGE_FILE_NAME.

Also remove the temporary debug prints from CMakeLists.txt and the
CPackConfig.cmake dump from build_packages_local.sh.
---
 CMakeLists.txt          | 14 ++++++++------
 build_packages_local.sh |  4 ----
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 395e4b7..fede586 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -342,10 +342,6 @@ if(BUILD_RELOCATABLE_PACKAGE)
   elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE} AND NOT "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
-  message(STATUS "TB_DEBUG resolved _tb_pkg_release=[${_tb_pkg_release}]")
-  message(STATUS "TB_DEBUG TRANSFERBENCH_PACKAGE_RELEASE=[${TRANSFERBENCH_PACKAGE_RELEASE}] defined=[${TRANSFERBENCH_PACKAGE_RELEASE-UNDEF}]")
-  message(STATUS "TB_DEBUG ENV CPACK_RPM_PACKAGE_RELEASE=[$ENV{CPACK_RPM_PACKAGE_RELEASE}]")
-  message(STATUS "TB_DEBUG ENV CPACK_DEBIAN_PACKAGE_RELEASE=[$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}]")
 
   # DEB
   set(CPACK_DEBIAN_PACKAGE_NAME       "${CPACK_PACKAGE_NAME}")
@@ -385,11 +381,17 @@ if(BUILD_RELOCATABLE_PACKAGE)
         "${_rpm_exclude_prefix}/bin")
 
   # TGZ — embed release tag so successive runs do not collide on the same key.
+  # CMake 3.13+ honors CPACK_ARCHIVE_FILE_NAME for archive generators, but
+  # CMake 3.22 (Ubuntu 22.04) falls back to CPACK_PACKAGE_FILE_NAME for TGZ.
+  # Set both to the same suffixed value. DEB/RPM are unaffected because they
+  # use the explicit DEB-DEFAULT / RPM-DEFAULT canonical-naming tokens above.
   if(_tb_pkg_release STREQUAL "")
-    set(CPACK_ARCHIVE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
+    set(_tb_archive_name "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
   else()
-    set(CPACK_ARCHIVE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${_tb_pkg_release}-Linux")
+    set(_tb_archive_name "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${_tb_pkg_release}-Linux")
   endif()
+  set(CPACK_ARCHIVE_FILE_NAME "${_tb_archive_name}")
+  set(CPACK_PACKAGE_FILE_NAME "${_tb_archive_name}")
 
   set(CPACK_GENERATOR "DEB;RPM;TGZ")
   include(CPack)
diff --git a/build_packages_local.sh b/build_packages_local.sh
index bd61ac1..c510a63 100755
--- a/build_packages_local.sh
+++ b/build_packages_local.sh
@@ -237,10 +237,6 @@ fi
 "${CMAKE_BIN}" "${CMAKE_ARGS[@]}"
 ok "CMake configured"
 
-echo "===== TB_DEBUG dump of CPACK_*_FILE_NAME from CPackConfig.cmake ====="
-grep -nE "CPACK_(ARCHIVE|PACKAGE|DEBIAN|RPM)_FILE_NAME|CPACK_(DEBIAN|RPM)_PACKAGE_RELEASE|TRANSFERBENCH_PACKAGE_RELEASE" "${BUILD_DIR}/CPackConfig.cmake" || true
-echo "===== END TB_DEBUG ====="
-
 # -------- build --------
 log "Building TransferBench (-j$(nproc))..."
 "${CMAKE_BIN}" --build "${BUILD_DIR}" -- -j"$(nproc)"

From 4ac1c0e5921c94a74615844065e07b8b7a75170c Mon Sep 17 00:00:00 2001
From: Arm Patinyasakdikul <arm.patinyasakdikul@amd.com>
Date: Wed, 13 May 2026 15:55:44 -0500
Subject: [PATCH 6/6] ci: address Copilot PR review on packaging changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace `git config --global --add safe.directory` with the GIT_CONFIG_*
  env-var triple so the safe.directory entry is scoped to this build (and
  inherited by CMake's `execute_process(git …)` children) instead of being
  written to root's ~/.gitconfig under sudo. Also drops the `|| true` so a
  setup failure surfaces immediately instead of letting the version probe
  silently fall back.

- Quote `"${VAR}"` in `STREQUAL ""` comparisons. CMake's `if(AND ...)` does
  not short-circuit, and bare-identifier dereferencing inside `if()` depends
  on policy CMP0054. Quoting makes the comparison unambiguous.

- Fail fast when BUILD_RELOCATABLE_PACKAGE is requested on CMake older than
  3.13. The block uses CPACK_ARCHIVE_FILE_NAME (3.13+) and the
  DEB-DEFAULT / RPM-DEFAULT canonical-naming sentinels (3.6+); on a 3.5
  CMake those would silently produce a literal "DEB-DEFAULT" filename. The
  project-wide cmake_minimum_required of 3.5 is left alone (out of scope
  here); the gate is local to the relocatable-package path.
---
 CMakeLists.txt          | 26 ++++++++++++++++++++------
 build_packages_local.sh | 11 ++++++++---
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index fede586..f8d1c74 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -302,6 +302,18 @@ if(BUILD_RELOCATABLE_PACKAGE)
   # RVS-style relocatable packaging: bypass rocm_install/rocm_create_package and
   # drive CPack directly so CMAKE_INSTALL_PREFIX / CPACK_PACKAGING_INSTALL_PREFIX
   # set by the caller (build_packages_local.sh) are honored.
+  #
+  # The CPack flow below uses CPACK_ARCHIVE_FILE_NAME (3.13+) and the
+  # DEB-DEFAULT / RPM-DEFAULT canonical-naming sentinels (3.6+). The
+  # project-wide cmake_minimum_required is 3.5 for the non-packaging build, so
+  # gate the relocatable path locally to avoid silently producing a literal
+  # "DEB-DEFAULT" filename on a too-old CMake.
+  if(CMAKE_VERSION VERSION_LESS 3.13)
+    message(FATAL_ERROR
+      "BUILD_RELOCATABLE_PACKAGE requires CMake >= 3.13 "
+      "(found ${CMAKE_VERSION}); needed for CPACK_ARCHIVE_FILE_NAME and "
+      "the DEB-DEFAULT / RPM-DEFAULT canonical-naming sentinels.")
+  endif()
   if(NOT DEFINED ROCM_MAJOR_VERSION)
     set(ROCM_MAJOR_VERSION "7")
   endif()
@@ -334,12 +346,14 @@ if(BUILD_RELOCATABLE_PACKAGE)
   # Per-build release tag, threaded into DEB/RPM metadata AND the TGZ filename.
   # Prefer the explicit -D from build_packages_local.sh; fall back to the env
   # vars CPack itself reads (so direct cmake invocations still work).
+  # Quote variable references throughout so the comparison is unambiguous
+  # under any CMP0054 setting.
   set(_tb_pkg_release "")
-  if(DEFINED TRANSFERBENCH_PACKAGE_RELEASE AND NOT TRANSFERBENCH_PACKAGE_RELEASE STREQUAL "")
+  if(NOT "${TRANSFERBENCH_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "${TRANSFERBENCH_PACKAGE_RELEASE}")
-  elseif(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE} AND NOT "$ENV{CPACK_RPM_PACKAGE_RELEASE}" STREQUAL "")
+  elseif(NOT "$ENV{CPACK_RPM_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
-  elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE} AND NOT "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}" STREQUAL "")
+  elseif(NOT "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}" STREQUAL "")
     set(_tb_pkg_release "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
   endif()
 
@@ -348,7 +362,7 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
   set(CPACK_DEBIAN_PACKAGE_DEPENDS    "numactl, libnuma1, hsa-rocr")
   set(CPACK_DEBIAN_PACKAGE_MAINTAINER "${CPACK_PACKAGE_CONTACT}")
-  if(NOT _tb_pkg_release STREQUAL "")
+  if(NOT "${_tb_pkg_release}" STREQUAL "")
     set(CPACK_DEBIAN_PACKAGE_RELEASE "${_tb_pkg_release}")
   elseif(DEFINED ENV{CPACK_DEBIAN_PACKAGE_RELEASE})
     set(CPACK_DEBIAN_PACKAGE_RELEASE "$ENV{CPACK_DEBIAN_PACKAGE_RELEASE}")
@@ -361,7 +375,7 @@ if(BUILD_RELOCATABLE_PACKAGE)
   set(CPACK_RPM_PACKAGE_LICENSE "MIT")
   set(CPACK_RPM_PACKAGE_REQUIRES "numactl, hsa-rocr")
   set(CPACK_RPM_PACKAGE_VENDOR  "${CPACK_PACKAGE_VENDOR}")
-  if(NOT _tb_pkg_release STREQUAL "")
+  if(NOT "${_tb_pkg_release}" STREQUAL "")
     set(CPACK_RPM_PACKAGE_RELEASE "${_tb_pkg_release}")
   elseif(DEFINED ENV{CPACK_RPM_PACKAGE_RELEASE})
     set(CPACK_RPM_PACKAGE_RELEASE "$ENV{CPACK_RPM_PACKAGE_RELEASE}")
@@ -385,7 +399,7 @@ if(BUILD_RELOCATABLE_PACKAGE)
   # CMake 3.22 (Ubuntu 22.04) falls back to CPACK_PACKAGE_FILE_NAME for TGZ.
   # Set both to the same suffixed value. DEB/RPM are unaffected because they
   # use the explicit DEB-DEFAULT / RPM-DEFAULT canonical-naming tokens above.
-  if(_tb_pkg_release STREQUAL "")
+  if("${_tb_pkg_release}" STREQUAL "")
     set(_tb_archive_name "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-Linux")
   else()
     set(_tb_archive_name "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${_tb_pkg_release}-Linux")
diff --git a/build_packages_local.sh b/build_packages_local.sh
index c510a63..91ace56 100755
--- a/build_packages_local.sh
+++ b/build_packages_local.sh
@@ -44,9 +44,14 @@ ROCM_PATH="${SDK_DIR}/install"
 # "dubious ownership" guard because the checkout is host-UID-owned but we run
 # as root. Without this, `git describe` in CMakeLists.txt silently fails and
 # TRANSFERBENCH_VERSION_PATCH falls back to its hard-coded default.
-if command -v git >/dev/null 2>&1; then
-  git config --global --add safe.directory "${REPO_ROOT}" || true
-fi
+#
+# Use GIT_CONFIG_* env vars (git >= 2.31) so the scoped safe.directory entry
+# is inherited by CMake's `execute_process(git …)` children without touching
+# the user's persistent ~/.gitconfig (especially harmful under sudo, where
+# the modification would land in root's global config).
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0="safe.directory"
+export GIT_CONFIG_VALUE_0="${REPO_ROOT}"
 
 # Default GPU targets baked into every package, regardless of GPU_FAMILY tarball.
 DEFAULT_GPU_TARGETS="gfx906;gfx908;gfx90a;gfx942;gfx950;gfx1030;gfx1100;gfx1101;gfx1102;gfx1150;gfx1151;gfx1200;gfx1201"