Refuse a manifest entry whose mode is above 0777 on load (closes #225)

Loading accepted an entry recording a mode above 0777, such as 04755.
check then reported a file with exactly the recorded permission bits
as a mode mismatch, list and export printed the out-of-range mode, and
freshen silently rewrote it as the permission bits alone. Loading now
refuses such an entry, naming the path and the mode, so every command
that reads a manifest refuses it with one message. fetch's own check
for this could no longer be reached and is gone; its test moves to the
loading tests in package mfer. docs/FORMAT.md says readers reject a
mode above 0777.

Model: opus-5-5

internal/cli/fetch.go

@@ -95,9 +95,6 @@ var (
 	// writes another file.
 	errNameClash = errors.New(
 		"manifest lists a file where fetch writes another file")
-	// errModeOutOfRange indicates a manifest that lists a mode with more
-	// than the permission bits, such as setuid.
-	errModeOutOfRange = errors.New("manifest lists a mode outside 0777")
 )
 
 // DownloadProgress reports the progress of a single file download.
@@ -428,9 +425,9 @@ func (mfa *CLIApp) fetchManifestOperation(
 
 // fetchManifest downloads the manifest at manifestURL and parses it,
 // enforcing --require-signature if it is given and refusing a manifest
-// that lists a file where fetch writes another or a mode outside 0777. It
-// returns the manifest as downloaded, to be saved once the files are in
-// place, and the files it lists.
+// that lists a file where fetch writes another. It returns the manifest as
+// downloaded, to be saved once the files are in place, and the files it
+// lists.
 func (mfa *CLIApp) fetchManifest(
 	ctx context.Context, cmd *cli.Command, client retryingClient, manifestURL string,
 ) ([]byte, []*mfer.MFFilePath, error) {
@@ -487,16 +484,6 @@ func (mfa *CLIApp) fetchManifest(
 		return nil, nil, err
 	}
 
-	// fetch sets each recorded mode on the file it writes, so a mode above
-	// 0777, which could carry setuid, setgid or sticky bits, is refused
-	// before any file is requested.
-	for _, f := range files {
-		if f.GetMode() > uint32(os.ModePerm) {
-			return nil, nil, fmt.Errorf("%w: %s (%#o)",
-				errModeOutOfRange, f.GetPath(), f.GetMode())
-		}
-	}
-
 	log.Infof("manifest contains %d files", len(files))
 
 	return manifestData, files, nil

internal/cli/fetch_test.go

@@ -19,15 +19,12 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
-	"uuid"
 
-	"github.com/klauspost/compress/zstd"
 	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	urfcli "github.com/urfave/cli/v3"
-	"google.golang.org/protobuf/proto"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -1535,27 +1532,9 @@ func TestFetchSetsRecordedMode(t *testing.T) {
 		[]string{"/" + defaultManifestName, "/" + testFileTxt}, requested)
 }
 
-// TestFetchRefusesModeOutsidePermissionBits fetches manifests that record
-// a mode with the setuid bit, once as Unix writes it (04755) and once as
-// Go keeps it in os.FileMode. fetch must refuse both before it creates the
-// destination or requests any file.
-func TestFetchRefusesModeOutsidePermissionBits(t *testing.T) {
-	t.Parallel()
-
-	files := map[string][]byte{testFileTxt: []byte("a file")}
-
-	assertFetchRefused(t, manifestWithMode(t, testFileTxt, files[testFileTxt], 0o4755),
-		files, "manifest lists a mode outside 0777: file.txt (04755)")
-
-	assertFetchRefused(t,
-		manifestWithMode(t, testFileTxt, files[testFileTxt],
-			uint32(os.ModeSetuid|0o755)),
-		files, "manifest lists a mode outside 0777: file.txt (040000755)")
-}
-
 // TestDownloadFileSetsOnlyPermissionBits downloads a file whose entry
 // records mode 0755 together with setuid, setgid or sticky, as Go keeps
-// them in os.FileMode. fetchManifest would refuse such an entry; called
+// them in os.FileMode. Loading a manifest refuses such an entry; called
 // directly, downloadFile must still set only the permission bits.
 func TestDownloadFileSetsOnlyPermissionBits(t *testing.T) {
 	t.Parallel()
@@ -1592,51 +1571,6 @@ func TestDownloadFileSetsOnlyPermissionBits(t *testing.T) {
 	}
 }
 
-// manifestWithMode returns a manifest listing one file, path, with content
-// and the given recorded mode. It is assembled by hand, since the builder
-// never records a mode outside 0777.
-func manifestWithMode(t *testing.T, path string, content []byte, mode uint32) []byte {
-	t.Helper()
-
-	digest := sha256.Sum256(content)
-	hash, err := multihash.Encode(digest[:], multihash.SHA2_256)
-	require.NoError(t, err)
-
-	id := uuid.NewV4()
-
-	inner, err := proto.Marshal(&mfer.MFFile{
-		Version: mfer.MFFile_VERSION_ONE,
-		Files: []*mfer.MFFilePath{{
-			Path:   path,
-			Size:   int64(len(content)),
-			Hashes: []*mfer.MFFileChecksum{{MultiHash: hash}},
-			Mode:   mode,
-		}},
-		Uuid: id[:],
-	})
-	require.NoError(t, err)
-
-	encoder, err := zstd.NewWriter(nil)
-	require.NoError(t, err)
-
-	compressed := encoder.EncodeAll(inner, nil)
-	require.NoError(t, encoder.Close())
-
-	sum := sha256.Sum256(compressed)
-
-	outer, err := proto.Marshal(&mfer.MFFileOuter{
-		Version:         mfer.MFFileOuter_VERSION_ONE,
-		CompressionType: mfer.MFFileOuter_COMPRESSION_ZSTD,
-		Size:            int64(len(inner)),
-		Sha256:          sum[:],
-		Uuid:            id[:],
-		InnerMessage:    compressed,
-	})
-	require.NoError(t, err)
-
-	return append([]byte(mfer.MAGIC), outer...)
-}
-
 // builtManifest returns a manifest of files, built directly rather than
 // scanned, since a scan lists no hidden files.
 func builtManifest(t *testing.T, files map[string][]byte) []byte {