From d254e0933f685cfde11112e5ecd16b35b70ef431 Mon Sep 17 00:00:00 2001
From: Nobuyoshi Nakada <nobu@ruby-lang.org>
Date: Sun, 6 Sep 2026 22:40:04 +0900
Subject: [PATCH] Create atomic save files without permissions

Prevent temporary files from exposing store data before their modes
are restored.
---
 lib/pstore.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pstore.rb b/lib/pstore.rb
index eefb3bb..6dd771d 100644
--- a/lib/pstore.rb
+++ b/lib/pstore.rb
@@ -698,7 +698,7 @@ def save_data(original_checksum, original_file_size, file)
 
   def save_data_with_atomic_file_rename_strategy(data, file)
     temp_filename = "#{@filename}.tmp.#{Process.pid}.#{rand 1000000}"
-    temp_file = File.new(temp_filename, **WR_ACCESS)
+    temp_file = File.new(temp_filename, **WR_ACCESS, perm: 0o000)
     begin
       temp_file.flock(File::LOCK_EX)
       temp_file.write(data)