From f0cbe64be0773aa8e25dfd25ccb0f5407044156e Mon Sep 17 00:00:00 2001 From: Alex Date: Sat, 22 Aug 2026 23:41:52 +0000 Subject: [PATCH] Keep the credential permission test independent of the caller umask. The installer runs with umask 077, so os.WriteFile could not create the group/other-readable profiles file the second half of the test relies on: the mode landed at 0400, Load correctly accepted it, and the assertion that a permissive file outside a credential directory is rejected failed. go test ./... therefore aborted every installation from a clean checkout. Restore the intended mode with an explicit chmod. The permission check in loadProfiles is unchanged; only the fixture was umask-sensitive. Co-Authored-By: Claude Opus 5 (1M context) --- internal/config/config_test.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/internal/config/config_test.go b/internal/config/config_test.go index d977312..49ae56a 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -234,6 +234,11 @@ func TestLoadAcceptsSystemdCredentialReadPermissions(t *testing.T) { if err := os.WriteFile(profiles, []byte(content), 0444); err != nil { t.Fatal(err) } + // os.WriteFile applies the process umask, so restore the read-only + // credential permissions the systemd credential directory really uses. + if err := os.Chmod(profiles, 0444); err != nil { + t.Fatal(err) + } t.Setenv("CREDENTIALS_DIRECTORY", credentials) server := `{"public_hostname":"proxy.example.com","public_dir":"public","profiles_file":"credentials/profiles.json"}` path := filepath.Join(directory, "config.json")