fix: keep the mirror readable under a umask that masks the owner's read bit

The umask handling added for group access cleared only the group bits and left
owner and other to the environment. A container whose umask carries 0400 then
produces mirror directories of mode 0300: writable and enterable, unreadable to
the very run that created them, and unreadable to anything serving the share.

Clear the owner read and execute bits from the umask as well. The `other` bits
stay where the environment puts them, because whether the mirror is
world-readable is a real policy question; being able to read a directory the
process itself just created is not.

Files were never exposed to this: mkstemp sets 0600 outright and copy2 takes
the source file's mode, both ignoring the umask.

music_mirror.py

@@ -84,7 +84,12 @@ MTIME_TOLERANCE_SECONDS = 2
 # that may be tighter still. Directories need the execute bit too, or the group
 # cannot enter them to reach the readable files inside.
 GROUP_READ = 0o040
-GROUP_ENTER = 0o050
+
+# Cleared from the umask so directories this run creates can be listed and
+# entered. Owner as well as group: a umask carrying 0400 -- which is unusual but
+# not ours to assume away -- otherwise produces a mirror tree that not even the
+# process that built it can read back.
+DIRECTORY_ACCESS = 0o550
 
 
 @dataclass
@@ -505,12 +510,14 @@ def main(argv=None):
     logging.basicConfig(format="%(asctime)s %(levelname)s %(message)s", level=logging.INFO)
     args = build_parser().parse_args(argv)
 
-    # Directories are created with 0o777 masked by the umask, so clear the group
-    # bits from it once here rather than chmod'ing every directory the walk
-    # creates. Files cannot be handled this way -- mkstemp and copy2 both set a
-    # mode outright -- so they get an explicit chmod instead.
+    # Directories are created with 0o777 masked by the umask, so clear the bits
+    # that matter from it once here rather than chmod'ing every directory the
+    # walk creates. The `other` bits are left alone, since whether the mirror is
+    # world-readable is a real policy question; owner and group access is not.
+    # Files cannot be handled this way -- mkstemp and copy2 both set a mode
+    # outright, ignoring the umask -- so they get an explicit chmod instead.
     inherited = os.umask(0o077)
-    os.umask(inherited & ~GROUP_ENTER)
+    os.umask(inherited & ~DIRECTORY_ACCESS)
 
     if not args.source or not args.mirror:
         logger.error("both --source and --mirror are required")