Reduce file and folder permissions across subo

builder/template/config.go

@@ -36,7 +36,7 @@ func TemplateRootDir() (string, error) {
 
 	if os.Stat(tmplPath); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			if err := os.MkdirAll(tmplPath, os.ModePerm); err != nil {
+			if err := os.MkdirAll(tmplPath, 0755); err != nil {
 				return "", errors.Wrap(err, "failed to MkdirAll template directory")
 			}
 		} else {

builder/template/templates.go

@@ -182,7 +182,7 @@ func ExecTmplDir(cwd, name, templatesPath, tmplName string, templateData interfa
 			data = []byte(builder.String())
 		}
 
-		if err := ioutil.WriteFile(filepath.Join(targetPath, targetRelPath), data, 0777); err != nil {
+		if err := ioutil.WriteFile(filepath.Join(targetPath, targetRelPath), data, 0600); err != nil {
 			return errors.Wrap(err, "failed to WriteFile")
 		}
 
@@ -219,7 +219,7 @@ func downloadZip(repo, branch, targetPath string) (string, error) {
 		}
 	}
 
-	if err := os.MkdirAll(targetPath, os.ModePerm); err != nil {
+	if err := os.MkdirAll(targetPath, 0755); err != nil {
 		return "", errors.Wrap(err, "failed to MkdirAll")
 	}
 

subo/command/create_runnable.go

@@ -156,7 +156,7 @@ func writeDotRunnable(cwd, name, lang, namespace string) (*directive.Runnable, e
 
 	path := filepath.Join(cwd, name, ".runnable.yaml")
 
-	if err := ioutil.WriteFile(path, bytes, 0700); err != nil {
+	if err := ioutil.WriteFile(path, bytes, 0600); err != nil {
 		return nil, errors.Wrap(err, "failed to WriteFile runnable")
 	}
 

subo/release/check.go

@@ -52,7 +52,7 @@ func cacheTimestamp(timestamp time.Time) error {
 
 	filePath := filepath.Join(cachePath, lastCheckedFilename)
 	data := []byte(timestamp.Format(time.RFC3339))
-	if err := ioutil.WriteFile(filePath, data, os.ModePerm); err != nil {
+	if err := ioutil.WriteFile(filePath, data, 0644); err != nil {
 		return errors.Wrap(err, "failed to WriteFile")
 	}
 
@@ -110,7 +110,7 @@ func cacheLatestRelease(latestRepoRelease *github.RepositoryRelease) error {
 	encoder := gob.NewEncoder(&buffer)
 	if err = encoder.Encode(latestRepoRelease); err != nil {
 		return errors.Wrap(err, "failed to Encode RepositoryRelease")
-	} else if err := ioutil.WriteFile(filepath.Join(cachePath, latestReleaseFilename), buffer.Bytes(), os.ModePerm); err != nil {
+	} else if err := ioutil.WriteFile(filepath.Join(cachePath, latestReleaseFilename), buffer.Bytes(), 0644); err != nil {
 		return errors.Wrap(err, "failed to WriteFile")
 	}
 

subo/util/cache.go

@@ -12,7 +12,7 @@ func CacheDir() (string, error) {
 	targetPath := filepath.Join(os.TempDir(), "suborbital", "subo")
 
 	if _, err := os.Stat(targetPath); os.IsNotExist(err) {
-		if err := os.MkdirAll(targetPath, os.ModePerm); err != nil {
+		if err := os.MkdirAll(targetPath, 0755); err != nil {
 			return "", errors.Wrap(err, "failed to MkdirAll")
 		}
 	}

subo/util/mkdir.go

@@ -11,7 +11,7 @@ import (
 func Mkdir(cwd, name string) (string, error) {
 	path := filepath.Join(cwd, name)
 
-	if err := os.Mkdir(path, 0777); err != nil {
+	if err := os.Mkdir(path, 0755); err != nil {
 		return "", errors.Wrap(err, "failed to Mkdir")
 	}
 

subo/util/token.go

@@ -1,10 +1,11 @@
 package util
 
 import (
-	"github.com/pkg/errors"
 	"io/ioutil"
 	"os"
 	"path/filepath"
+
+	"github.com/pkg/errors"
 )
 
 func getTokenTmpDir() string {
@@ -15,12 +16,12 @@ func getTokenTmpDir() string {
 func WriteEnvironmentToken(tokenStr string) error {
 	tokenPath := getTokenTmpDir()
 	if _, err := os.Stat(tokenPath); os.IsNotExist(err) {
-		if err := os.MkdirAll(filepath.Dir(tokenPath), os.ModePerm); err != nil {
+		if err := os.MkdirAll(filepath.Dir(tokenPath), 0755); err != nil {
 			return errors.Wrap(err, "failed to Mkdir")
 		}
 	}
 
-	if err := ioutil.WriteFile(tokenPath, []byte(tokenStr), 0700); err != nil {
+	if err := ioutil.WriteFile(tokenPath, []byte(tokenStr), 0600); err != nil {
 		return errors.Wrap(err, "failed to WriteFile for token")
 	}
 	return nil