From bd7fb76d4c6fdda501651df1674bc34dbffc6ec4 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 23 Oct 2026 09:29:39 -0400 Subject: [PATCH] fix: annotate package output permissions (SonarCloud rust:S2612) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New packages are created with the ordinary 0666 request; the process umask decides the effective mode. Annotated with that reason so the analyzer's world-writable warning does not change the intended sharing behaviour. 🤖 Generated with Codebuff Co-Authored-By: Codebuff --- crates/engine/src/cmd/package.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/crates/engine/src/cmd/package.rs b/crates/engine/src/cmd/package.rs index f2d33ccf..d0ed58b0 100644 --- a/crates/engine/src/cmd/package.rs +++ b/crates/engine/src/cmd/package.rs @@ -135,8 +135,9 @@ impl OutputRoot { { use std::os::unix::fs::PermissionsExt; - // Match fs::write for a new output: 0666 restricted by the caller's umask. - builder.permissions(std::fs::Permissions::from_mode(0o666)); + // Like fs::write for a new output: request 0666 and let the process umask decide the + // effective mode (0644 with the usual 022, 0664 with 002). + builder.permissions(std::fs::Permissions::from_mode(0o666)); // NOSONAR } let file = builder.tempfile_in(parent).map_err(|e| path_error(path, e))?; #[cfg(unix)]