diff options
| author | Ludovic Courtès <ludo@gnu.org> | 2020-11-08 23:35:45 +0100 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2020-11-08 23:39:33 +0100 |
| commit | 464e7437f46e7c4199fa98dcc52b4d46e8d8a48e (patch) | |
| tree | ebb1a7a3e93296c0c660a2583dd2b15ba5e60b2c | |
| parent | 495acfc56602c1bd768d470256704cf1ff80540a (diff) | |
publish: Create files in the cache as #o644.
Reported by Ricardo Wurmus <rekado@elephly.net>.
* guix/scripts/publish.scm (compress-nar): Add 'chmod' call to ensure
PORT is #o644, in the uncompressed case.
(bake-narinfo+nar): Likewise for the narinfo file.
* tests/publish.scm ("with cache"): Check permissions on CACHED and NAR.
| -rw-r--r-- | guix/scripts/publish.scm | 12 | ||||
| -rw-r--r-- | tests/publish.scm | 5 |
2 files changed, 15 insertions, 2 deletions
diff --git a/guix/scripts/publish.scm b/guix/scripts/publish.scm index e8faf379e2..e3c8711f5b 100644 --- a/guix/scripts/publish.scm +++ b/guix/scripts/publish.scm @@ -583,7 +583,10 @@ requested using POOL." ;; guarantee the TTL (see <https://bugs.gnu.org/28664>.) (with-atomic-file-output nar (lambda (port) - (write-file item port)))))) + (write-file item port) + ;; Make the file world-readable, contrary to what + ;; 'with-atomic-file-output' does. + (chmod port (logand #o644 (lognot (umask))))))))) (define* (bake-narinfo+nar cache item #:key ttl (compressions (list %no-compression)) @@ -615,7 +618,12 @@ requested using POOL." #:nar-path nar-path #:compressions compressions #:file-sizes sizes) - port))))) + port))) + + ;; Make the cached narinfo world-readable, contrary to what + ;; 'with-atomic-file-output' does, so that other users can rsync + ;; the whole cache. + (chmod port (logand #o644 (lognot (umask)))))) ;; Make narinfo files for OTHERS hard links to NARINFO such that the ;; atime-based cache eviction considers either all the nars or none diff --git a/tests/publish.scm b/tests/publish.scm index e46e6256b7..cafd0f13a2 100644 --- a/tests/publish.scm +++ b/tests/publish.scm @@ -434,6 +434,11 @@ References: ~%" (< ttl 3600))) (wait-for-file cached) + + ;; Both the narinfo and nar should be world-readable. + (= #o644 (stat:perms (lstat cached))) + (= #o644 (stat:perms (lstat nar))) + (let* ((body (http-get-port url)) (compressed (http-get nar-url)) (uncompressed (http-get (string-append base "nar/" |