Skip to content

fix(archive): preserve special permission bits - #820

Open
stephenlclarke wants to merge 1 commit into
apple:mainfrom
stephenlclarke:fix/archive-special-permission-bits
Open

fix(archive): preserve special permission bits#820
stephenlclarke wants to merge 1 commit into
apple:mainfrom
stephenlclarke:fix/archive-special-permission-bits

Conversation

@stephenlclarke

@stephenlclarke stephenlclarke commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Preserve sticky, set-user-ID, and set-group-ID permission bits when extracting archive entries.

Motivation and Context

During testing of my container-compose plugin, I found and fixed the following issue: archive extraction masked entry permissions with 0o777, which discarded all special POSIX permission bits.

This regressed in #816. A directory archived with mode 01777 was extracted as 0777; set-user-ID and set-group-ID bits were affected by the same mask.

Fixes #818.

Reproduction

  1. Write a directory archive entry with mode 01777.

  2. Extract it with ArchiveReader.

  3. Inspect the extracted directory's POSIX permissions.

  4. Run:

    swift test --disable-automatic-resolution -Xswiftc -warnings-as-errors --filter preserveSpecialPermissionBits

On stock main at 50f77222964ed3d01dcb53f803ea2d511656a9dc, the regression failed with:

Expectation failed: ((perms & permMask) -> 511) == (0o1777 -> 1023)
Special permission bits should be preserved

Changes

  • Apply entry.permissions & 0o7777 instead of entry.permissions & 0o777.
  • Add a sticky-directory archive extraction regression.

Validation

Validated on macOS 26.5.1 (25F80), Xcode 26.6 (17F113), and Swift 6.3.3.

  • Regression before fix: failed with 0777 instead of 01777
  • Regression after fix: passed
  • make fmt: passed
  • make check: passed
  • swift test --enable-code-coverage --disable-automatic-resolution -Xswiftc -warnings-as-errors: 574 tests in 80 suites passed
  • git diff --check: passed
  • Commit 6e32963617b3ed8f4b63432dbcf834f94807342b is cryptographically signed and verified

Compatibility and Risk

The change preserves the complete POSIX permission field while still excluding file-type bits. It does not change archive formats or public APIs. The behavioural change is limited to restoring permissions that are already present in the archive entry.

Related

Release Note Highlight

Archive extraction now preserves sticky, set-user-ID, and set-group-ID permission bits.

Archive extraction masked modes to ordinary rwx bits, stripping sticky, set-user-ID, and set-group-ID permissions. Preserve the full POSIX permission mask and add a sticky-directory regression.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: archive extraction strips special permission bits

1 participant