From fa93476896700f990e303cf3f60caa77f30df625 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sun, 4 Jan 2026 00:55:23 +0900 Subject: internal/pkg: override working directory perms This must be writable to enable renaming, and the final result is conventionally read-only alongside the entire directory contents. This change overrides the permission bits as part of Store. Signed-off-by: Ophestra --- internal/pkg/pkg.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'internal/pkg/pkg.go') diff --git a/internal/pkg/pkg.go b/internal/pkg/pkg.go index 1bc910ed..76e25d65 100644 --- a/internal/pkg/pkg.go +++ b/internal/pkg/pkg.go @@ -259,6 +259,11 @@ func (c *Cache) Store( if err = makeArtifact(workPathname); err != nil { return } + // override this before hashing since it will be made read-only after the + // rename anyway so do not let perm bits affect the checksum + if err = os.Chmod(workPathname.String(), 0700); err != nil { + return + } var checksum Checksum if checksum, err = HashDir(workPathname); err != nil { return @@ -280,7 +285,10 @@ func (c *Cache) Store( if !errors.Is(err, os.ErrExist) { return } + } else if err = os.Chmod(checksumPathname.String(), 0500); err != nil { + return } + if linkErr := os.Symlink( "../"+dirChecksum+"/"+path.Base(checksumPathname.String()), pathname.String(), -- cgit v1.3.1