From d75475762824a4fa7e743138da6a9d59d8690a33 Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sun, 8 Nov 2020 23:35:45 +0100 Subject: publish: Create files in the cache as #o644. Reported by Ricardo Wurmus . * guix/scripts/publish.scm (compress-nar): Add 'chmod' call to ensure PORT is #o644, in the uncompressed case. (bake-narinfo+nar): Likewise for the narinfo file. * tests/publish.scm ("with cache"): Check permissions on CACHED and NAR. --- guix/scripts/publish.scm | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'guix/scripts/publish.scm') diff --git a/guix/scripts/publish.scm b/guix/scripts/publish.scm index e8faf379e2..e3c8711f5b 100644 --- a/guix/scripts/publish.scm +++ b/guix/scripts/publish.scm @@ -583,7 +583,10 @@ requested using POOL." ;; guarantee the TTL (see .) (with-atomic-file-output nar (lambda (port) - (write-file item port)))))) + (write-file item port) + ;; Make the file world-readable, contrary to what + ;; 'with-atomic-file-output' does. + (chmod port (logand #o644 (lognot (umask))))))))) (define* (bake-narinfo+nar cache item #:key ttl (compressions (list %no-compression)) @@ -615,7 +618,12 @@ requested using POOL." #:nar-path nar-path #:compressions compressions #:file-sizes sizes) - port))))) + port))) + + ;; Make the cached narinfo world-readable, contrary to what + ;; 'with-atomic-file-output' does, so that other users can rsync + ;; the whole cache. + (chmod port (logand #o644 (lognot (umask)))))) ;; Make narinfo files for OTHERS hard links to NARINFO such that the ;; atime-based cache eviction considers either all the nars or none -- cgit v1.2.3