internal/pkg: override working directory perms

This must be writable to enable renaming, and the final result is conventionally read-only alongside the entire directory contents. This change overrides the permission bits as part of Store.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/pkg/pkg.go

@@ -259,6 +259,11 @@ func (c *Cache) Store(
 	if err = makeArtifact(workPathname); err != nil {
 		return
 	}
+	// override this before hashing since it will be made read-only after the
+	// rename anyway so do not let perm bits affect the checksum
+	if err = os.Chmod(workPathname.String(), 0700); err != nil {
+		return
+	}
 	var checksum Checksum
 	if checksum, err = HashDir(workPathname); err != nil {
 		return
@@ -280,7 +285,10 @@ func (c *Cache) Store(
 		if !errors.Is(err, os.ErrExist) {
 			return
 		}
+	} else if err = os.Chmod(checksumPathname.String(), 0500); err != nil {
+		return
 	}
+
 	if linkErr := os.Symlink(
 		"../"+dirChecksum+"/"+path.Base(checksumPathname.String()),
 		pathname.String(),