Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: go.mod and go.sum are written with mode 0600 #31871

Closed
adg opened this issue May 6, 2019 · 3 comments
Closed

cmd/go: go.mod and go.sum are written with mode 0600 #31871

adg opened this issue May 6, 2019 · 3 comments
Labels
FrozenDueToAge GoCommand cmd/go modules NeedsFix The path to resolution is known, but the work has not been done.
Milestone
Go1.13

Comments

@adg
Copy link
Contributor

adg commented May 6, 2019

I noticed that the go.mod and go.sum files in my projects written with 0600 permissions (readable and writable only by the owner).

-rw-------    1 adg  eng   2487 May  6 17:02 go.mod
-rw-------    1 adg  eng  29364 May  6 17:02 go.sum

This is a bit unusual; I would have expected them to be written with 0644 (also readable to group and others), like all the other regular files in my Git repo.

I tracked this down to being a side-effect of the cmd/go/internal/renameio package, which first creates the files with ioutil.TempFile, which calls OpenFile with mode 0600 (a perfectly reasonable thing to do when creating a file in a system temporary directory).

If this behavior is deemed undesirable (and that's my opinion) then I think the fix is to have renameio call Chmod on the file after moving it out of the temporary directory.

cc @bcmills
@bradfitz bradfitz added the NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made. label May 6, 2019
@bradfitz bradfitz added this to the Go1.13 milestone May 6, 2019
@bradfitz
Copy link
Contributor

bradfitz commented May 6, 2019

I likewise suspect this wasn't intentional.

@bcmills
Copy link
Contributor

bcmills commented May 7, 2019

It was not intentional. I used ioutil.TempFile assuming that an explicit dir argument would create the file using the default umask for that dir, but it doesn't: for some reason it masks the permission to 0600.

Probably the fix is to just stop using ioutil.TempFile.

@bcmills bcmills added the NeedsFix The path to resolution is known, but the work has not been done. label May 7, 2019
@gopherbot gopherbot removed the NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made. label May 7, 2019
@gopherbot
Copy link

Change https://golang.org/cl/175958 mentions this issue: cmd/go/internal/renameio: allow write file with the specified permissions

@golang golang locked and limited conversation to collaborators May 14, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge GoCommand cmd/go modules NeedsFix The path to resolution is known, but the work has not been done.
Projects
None yet
Milestone
Go1.13
Development

No branches or pull requests
5 participants
@bradfitz @bcmills @adg @gopherbot @thepudds