# Goa Build Error - "depot\_dir" & "allowed\_paths"

**URL:** <https://genode.discourse.group/t/goa-build-error-depot-dir-allowed-paths/368>\
**Category:** Developer's Corner\
**Created:** [October 12, 2026, 6:49pm UTC](https://genode.discourse.group/t/goa-build-error-depot-dir-allowed-paths/368 "2026-10-12T18:49:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjkarcher](https://avatars.discourse-cdn.com/v4/letter/j/a9adbd/32.png) [@jjkarcher](https://genode.discourse.group/u/jjkarcher)\
**Post date:** [October 12, 2026, 6:49pm UTC](https://genode.discourse.group/t/goa-build-error-depot-dir-allowed-paths/368/1 "2026-10-12T18:49:10Z")

</div>

Sorry to be a pain. When trying to “goa build” a library cloned from Codeberg, I get the following error:

```auto
[lvgl_support] Error: In /home/mainuser/Devel/genode_jjk/goa-projects/goarc: 
 Path variable 'depot_dir' set to '/home/mainuser/Devel/genode_jjk/genode/depot' 
 defines an invalid path. Valid paths are:
 
 /home/mainuser/Devel/genode_jjk/goa-projects/ports/lvgl_support 

 You may consider setting 'allowed_paths' in your $HOME/goarc or /goarc file.

```

(This happens on other libraries also, so it is not specific to this package.)

Could someone say a few words about what this signifies, and/or whether the recommended change is the correct solution, or if there is a deeper root cause?

Thanks!

---

<div class="post-metadata">

**Author:** ![tickzip](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@tickzip](https://genode.discourse.group/u/tickzip)\
**Post date:** [October 12, 2026, 7:29pm UTC](https://genode.discourse.group/t/goa-build-error-depot-dir-allowed-paths/368/2 "2026-10-12T19:29:34Z")

</div>

> [@jjkarcher](#):
>
> Could someone say a few words about what this signifies, and/or whether the recommended change is the correct solution, or if there is a deeper root cause?

> By default, Goa prevents definition of path variables outside the current working directory or project directory.

This is a security measure (see [#99](https://codeberg.org/genodelabs/goa/issues/99)), so Goa requires you to allow this path using a “trusted” goarc file.