Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: go.mod and go.sum are written with mode 0600 #31871

Closed
adg opened this issue May 6, 2019 · 3 comments
Closed

cmd/go: go.mod and go.sum are written with mode 0600 #31871

adg opened this issue May 6, 2019 · 3 comments

Comments

@adg
Copy link
Contributor

@adg adg commented May 6, 2019

I noticed that the go.mod and go.sum files in my projects written with 0600 permissions (readable and writable only by the owner).

-rw-------    1 adg  eng   2487 May  6 17:02 go.mod
-rw-------    1 adg  eng  29364 May  6 17:02 go.sum

This is a bit unusual; I would have expected them to be written with 0644 (also readable to group and others), like all the other regular files in my Git repo.

I tracked this down to being a side-effect of the cmd/go/internal/renameio package, which first creates the files with ioutil.TempFile, which calls OpenFile with mode 0600 (a perfectly reasonable thing to do when creating a file in a system temporary directory).

If this behavior is deemed undesirable (and that's my opinion) then I think the fix is to have renameio call Chmod on the file after moving it out of the temporary directory.

cc @bcmills

@bradfitz bradfitz added this to the Go1.13 milestone May 6, 2019
@bradfitz

This comment has been minimized.

Copy link
Member

@bradfitz bradfitz commented May 6, 2019

I likewise suspect this wasn't intentional.

@bcmills

This comment has been minimized.

Copy link
Member

@bcmills bcmills commented May 7, 2019

It was not intentional. I used ioutil.TempFile assuming that an explicit dir argument would create the file using the default umask for that dir, but it doesn't: for some reason it masks the permission to 0600.

Probably the fix is to just stop using ioutil.TempFile.

@bcmills bcmills added the NeedsFix label May 7, 2019
@gopherbot gopherbot removed the NeedsDecision label May 7, 2019
@gopherbot

This comment has been minimized.

Copy link

@gopherbot gopherbot commented May 9, 2019

Change https://golang.org/cl/175958 mentions this issue: cmd/go/internal/renameio: allow write file with the specified permissions

@gopherbot gopherbot closed this in cefc0bb May 15, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.