Fix: Allow complex file modes for debs and apks.

apk/apk.go

@@ -471,6 +471,9 @@ func copyToTarAndDigest(file *files.Content, tw *tar.Writer, sizep *int64) error
 		return err
 	}
 
+	// tar.FileInfoHeader only uses file.Mode().Perm() which masks the mode with
+	// 0o777 which we don't want because we want to be able to set the suid bit.
+	header.Mode = int64(file.Mode())
 	header.Name = files.ToNixPath(file.Destination[1:])
 	header.Uname = file.FileInfo.Owner
 	header.Gname = file.FileInfo.Group

deb/deb.go

@@ -343,6 +343,10 @@ func copyToTarAndDigest(file *files.Content, tw *tar.Writer, md5w io.Writer) (in
 		log.Print(err)
 		return 0, err
 	}
+
+	// tar.FileInfoHeader only uses file.Mode().Perm() which masks the mode with
+	// 0o777 which we don't want because we want to be able to set the suid bit.
+	header.Mode = int64(file.Mode())
 	header.Format = tar.FormatGNU
 	header.Name = normalizePath(file.Destination)
 	header.Uname = file.FileInfo.Owner

testdata/acceptance/apk.dockerfile

@@ -47,6 +47,7 @@ RUN test -f /usr/share/whatever/folder/folder2/file1
 RUN test -f /usr/share/whatever/folder/folder2/file2
 RUN test -d /var/log/whatever
 RUN test -d /usr/share/foo
+RUN test $(stat -c %a /usr/sbin/fake) -eq 4755
 RUN test -f /tmp/preinstall-proof
 RUN test -f /tmp/postinstall-proof
 RUN test ! -f /tmp/preremove-proof
@@ -55,6 +56,7 @@ RUN echo wat >> /etc/foo/whatever.conf
 RUN apk del foo
 RUN test -f /etc/foo/whatever.conf
 RUN test ! -f /usr/local/bin/fake
+RUN test ! -f /usr/sbin/fake
 RUN test -f /tmp/preremove-proof
 RUN test -f /tmp/postremove-proof
 RUN test ! -d /var/log/whatever

testdata/acceptance/core.complex.yaml

@@ -27,6 +27,10 @@ contents:
 - src: ./testdata/whatever.conf
   dst: /etc/foo/whatever.conf
   type: config
+- src: ./testdata/fake
+  dst: /usr/sbin/fake
+  file_info:
+    mode: 04755
 empty_folders:
 - /var/log/whatever
 - /usr/share/foo

testdata/acceptance/deb.dockerfile

@@ -50,6 +50,7 @@ RUN test -f /usr/share/whatever/folder/folder2/file1
 RUN test -f /usr/share/whatever/folder/folder2/file2
 RUN test -d /var/log/whatever
 RUN test -d /usr/share/foo
+RUN test $(stat -c %a /usr/sbin/fake) -eq 4755
 RUN test -f /tmp/preinstall-proof
 RUN test -f /tmp/postinstall-proof
 RUN test ! -f /tmp/preremove-proof
@@ -58,12 +59,12 @@ RUN echo wat >> /etc/foo/whatever.conf
 RUN dpkg -r foo
 RUN test -f /etc/foo/whatever.conf
 RUN test ! -f /usr/local/bin/fake
+RUN test ! -f /usr/sbin/fake
 RUN test -f /tmp/preremove-proof
 RUN test -f /tmp/postremove-proof
 RUN test ! -d /var/log/whatever
 RUN test ! -d /usr/share/foo
 
-
 # ---- signed test ----
 FROM test_base AS signed
 COPY keys/pubkey.gpg /usr/share/debsig/keyrings/9890904DFB2EC88A/debsig.gpg

testdata/acceptance/rpm.dockerfile

@@ -49,6 +49,7 @@ RUN test -f /usr/share/whatever/folder/folder2/file1
 RUN test -f /usr/share/whatever/folder/folder2/file2
 RUN test -d /var/log/whatever
 RUN test -d /usr/share/foo
+RUN test $(stat -c %a /usr/sbin/fake) -eq 4755
 RUN test -f /tmp/preinstall-proof
 RUN test -f /tmp/postinstall-proof
 RUN test -f /tmp/pretrans-proof
@@ -59,6 +60,7 @@ RUN echo wat >> /etc/foo/whatever.conf
 RUN rpm -e foo
 RUN test -f /etc/foo/whatever.conf.rpmsave
 RUN test ! -f /usr/local/bin/fake
+RUN test ! -f /usr/sbin/fake
 RUN test -f /tmp/preremove-proof
 RUN test -f /tmp/postremove-proof
 RUN test ! -d /var/log/whatever

www/docs/configuration.md

@@ -166,6 +166,7 @@ contents:
   - src: path/to/foo
     dst: /usr/local/foo
     file_info:
+      # Make sure that the mode is specified in octal, e.g. 0644 instead of 644.
       mode: 0644
       mtime: 2008-01-02T15:04:05Z
       owner: notRoot