security/hakurei
6
3
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

internal/pkg: override working directory perms
Some checks failed
Test / Flake checks (push) Has been cancelled
Details
Test / Hakurei (race detector) (push) Has started running
Details
Test / Sandbox (push) Has been cancelled
Details
Test / Create distribution (push) Has been cancelled
Details
Test / Hpkg (push) Has been cancelled
Details
Test / Hakurei (push) Has been cancelled
Details
Test / ShareFS (push) Has been cancelled
Details
Test / Sandbox (race detector) (push) Has been cancelled
Details

Browse Source 
This must be writable to enable renaming, and the final result is conventionally read-only alongside the entire directory contents. This change overrides the permission bits as part of Store.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2026-01-04 00:55:23 +09:00
parent bd0ef086b1
commit 897c14f8ea
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
internal/pkg/pkg.go
View File

@@ -259,6 +259,11 @@ func (c *Cache) Store(
if err = makeArtifact(workPathname); err != nil {
return
}
// override this before hashing since it will be made read-only after the
// rename anyway so do not let perm bits affect the checksum
if err = os.Chmod(workPathname.String(), 0700); err != nil {
return
}
var checksum Checksum
if checksum, err = HashDir(workPathname); err != nil {
return
@@ -280,7 +285,10 @@ func (c *Cache) Store(
if !errors.Is(err, os.ErrExist) {
return
}
} else if err = os.Chmod(checksumPathname.String(), 0500); err != nil {
return
}
if linkErr := os.Symlink(
"../"+dirChecksum+"/"+path.Base(checksumPathname.String()),
pathname.String(),