tine: build with umask 022

bin/BUCK

@@ -3,8 +3,9 @@
 
 """The command a checkout builds through."""
 
-load("//box:test.bzl", "box_python_test")
+load("//box:test.bzl", "box_python_test", "box_sh_test")
 load("//python:defs.bzl", "tine_python_library")
+load(":umask_test.bzl", "umask_probe")
 
 # How the launcher reads the cache settings and talks to a running shim, for the round trip in
 # tests/, which judges a build by the shim's own counters.
@@ -34,3 +35,20 @@ box_python_test(
         "//:buckconfig",
     ],
 )
+
+umask_probe(name = "umask-probe")
+
+# The launcher runs Buck with umask 022, so that a builder's own umask does not reach image
+# directories; this fails when built with a umask such as 0002 without that.
+box_sh_test(
+    name = "umask-test",
+    args = ["$(location :umask-probe)/directory"],
+    box = "//tools:dev.box",
+    script = """
+mode=$(stat -c %a "$1")
+if [ "$mode" != 755 ]; then
+    echo "ERROR: $1 has mode $mode, expected 755" >&2
+    exit 1
+fi
+""",
+)

bin/tine.py

@@ -1722,6 +1722,9 @@ def before_shim(
 
 
 def buck_command(argv: list[str]) -> None:
+    # Buck stores no directory mode and creates directories in its outputs with its own umask.
+    # Normalize that to the 0755 that images.md promises.
+    os.umask(0o022)
     root = project_root(cwd())
     ensure_home(root)
     settings = project_settings(root)

bin/umask_test.bzl

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: Amutable GmbH <https://amutable.com/>
+# SPDX-License-Identifier: MPL-2.0
+
+"""An action that creates a directory, to test the umask the launcher runs Buck with."""
+
+load("//box:runtime.bzl", "BoxInfo", "box_run")
+
+def _umask_probe_impl(ctx: AnalysisContext) -> list[Provider]:
+    out = ctx.actions.declare_output("probe", dir = True)
+    ctx.actions.run(
+        cmd_args(box_run(box = ctx.attrs._box[BoxInfo]), "mkdir", "-p", cmd_args(out.as_output(), format = "{}/directory")),
+        category = "umask_probe",
+    )
+    return [DefaultInfo(default_output = out)]
+
+umask_probe = rule(
+    impl = _umask_probe_impl,
+    attrs = {
+        "_box": attrs.exec_dep(providers = [BoxInfo], default = "tine//tools:dev.box"),
+    },
+)