Restore permissions.restoreRegularFile removes any existing entry, then creates the file with O_CREATE|O_EXCL at mode 0600, writes the content, closes, and only then applies the stored mode. A restrictive stored mode is therefore never briefly readable by other local users during the write (the previous default-mode create left that window open, and every file in a path-filtered restore is affected because ancestor directories outside the restored set are 0755). A file whose write or close fails is removed instead of left partial. A chmod failure on a regular file is now a user-visible warning, not a debug line. Directory restore keeps its prior behaviour (mode set via chmod, non-fatal).
Blob hash check.hashVerifyReader.Close now returns an error when closed before EOF, so a short read or early close can never yield an unverified blob. downloadBlobToCache deletes the cache entry on any copy/close failure, so a blob that failed its hash is never read back as valid.
Verify.verifyFile (--verify) now confirms the restored file is at EOF after its last chunk, rejecting trailing bytes. Per the issue, no whole-file length check against files.size was added.
Tests (under umask 022) cover: a 0600 file is never observed wider than 0600 during the write and ends at 0600; a failed write leaves no file; a partial read then Close errors; and a restored file with a trailing byte fails --verify.
Model: opus-4-8
Fixes https://git.eeqj.de/sneak/vaultik/issues/163 (found by the review in https://git.eeqj.de/sneak/vaultik/issues/73).
**Restore permissions.** `restoreRegularFile` removes any existing entry, then creates the file with `O_CREATE|O_EXCL` at mode 0600, writes the content, closes, and only then applies the stored mode. A restrictive stored mode is therefore never briefly readable by other local users during the write (the previous default-mode create left that window open, and every file in a path-filtered restore is affected because ancestor directories outside the restored set are 0755). A file whose write or close fails is removed instead of left partial. A chmod failure on a regular file is now a user-visible warning, not a debug line. Directory restore keeps its prior behaviour (mode set via chmod, non-fatal).
**Blob hash check.** `hashVerifyReader.Close` now returns an error when closed before EOF, so a short read or early close can never yield an unverified blob. `downloadBlobToCache` deletes the cache entry on any copy/close failure, so a blob that failed its hash is never read back as valid.
**Verify.** `verifyFile` (`--verify`) now confirms the restored file is at EOF after its last chunk, rejecting trailing bytes. Per the issue, no whole-file length check against `files.size` was added.
Tests (under umask 022) cover: a 0600 file is never observed wider than 0600 during the write and ends at 0600; a failed write leaves no file; a partial read then `Close` errors; and a restored file with a trailing byte fails `--verify`.
Model: opus-4-8
Regular files are now created with O_EXCL at mode 0600 and given their
stored mode only after the content is written and closed, so a file
whose stored mode is restrictive is never briefly readable by other
local users mid-restore. A file whose write or close fails is removed
rather than left partial, and a chmod failure is a user-visible warning
instead of a debug line.
hashVerifyReader.Close now errors when closed before EOF, so a short
read or early close can never obtain a blob whose hash was not verified;
downloadBlobToCache drops the cache entry on any such failure.
verifyFile (--verify) now rejects a restored file with bytes past its
last chunk.
Tests cover each behaviour under umask 022.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #163 (found by the review in #73).
Restore permissions.
restoreRegularFileremoves any existing entry, then creates the file withO_CREATE|O_EXCLat mode 0600, writes the content, closes, and only then applies the stored mode. A restrictive stored mode is therefore never briefly readable by other local users during the write (the previous default-mode create left that window open, and every file in a path-filtered restore is affected because ancestor directories outside the restored set are 0755). A file whose write or close fails is removed instead of left partial. A chmod failure on a regular file is now a user-visible warning, not a debug line. Directory restore keeps its prior behaviour (mode set via chmod, non-fatal).Blob hash check.
hashVerifyReader.Closenow returns an error when closed before EOF, so a short read or early close can never yield an unverified blob.downloadBlobToCachedeletes the cache entry on any copy/close failure, so a blob that failed its hash is never read back as valid.Verify.
verifyFile(--verify) now confirms the restored file is at EOF after its last chunk, rejecting trailing bytes. Per the issue, no whole-file length check againstfiles.sizewas added.Tests (under umask 022) cover: a 0600 file is never observed wider than 0600 during the write and ends at 0600; a failed write leaves no file; a partial read then
Closeerrors; and a restored file with a trailing byte fails--verify.Model: opus-4-8
PASS
Model: opus-4-8