fix: group-readable mirror output, and atomic copies #4

Merged

lyrathorpe merged 4 commits from fix/group-readable-output into main 2026-08-24 13:23:36 +01:00

Conversation 0 Commits 4 Files Changed 4

+227 -5

4 Commits

Author	SHA1	Message	Date
Emma Thorpe	e9852e6c86	fix: keep the mirror readable under a umask that masks the owner's read bit ... The umask handling added for group access cleared only the group bits and left owner and other to the environment. A container whose umask carries 0400 then produces mirror directories of mode 0300: writable and enterable, unreadable to the very run that created them, and unreadable to anything serving the share. Clear the owner read and execute bits from the umask as well. The `other` bits stay where the environment puts them, because whether the mirror is world-readable is a real policy question; being able to read a directory the process itself just created is not. Files were never exposed to this: mkstemp sets 0600 outright and copy2 takes the source file's mode, both ignoring the umask.	2026-08-24 13:21:07 +01:00
Emma Thorpe	a1382185a7	fix: copy through a temporary file so a cut-short copy is not kept ... Copies of already-MP3 sources were written straight to their destination while encodes went via a temporary file and a rename. A copy interrupted by a full disk, a killed container or an I/O error therefore left a truncated MP3 in the mirror -- and because shutil.copy2 reproduces the source's mtime along with its bytes, staleness detection would read that fragment as up to date and never replace it. The damage is silent and permanent until someone plays the track. Give copy the same temporary-file-and-rename path encode already uses, so the destination either has the whole file or has nothing.	2026-08-24 11:36:08 +01:00
Emma Thorpe	6e48d94b32	docs: describe how the mirror handles permissions ... Explain why the group bits are set explicitly rather than left to the umask, what is deliberately not touched, and that an existing mirror is repaired in place rather than re-encoded.	2026-08-24 11:36:08 +01:00
Emma Thorpe	100671da99	fix: make everything written into the mirror group-readable ... The mirror is written by one account and read by another -- an SMB share, or whatever else serves it -- but nothing here produced a group-readable file. Encodes go through `tempfile.mkstemp`, which creates 0600 regardless of the umask and keeps that mode through the rename into place, so every encoded track landed unreadable. Copies of existing MP3s inherit the mode of a source file in a library this tool does not own, which may be no better. Add the group-read bit explicitly: to the temporary file before it is renamed, so a mirror file is never visible without it, and to a copy once it has landed. Directories are handled by clearing the group bits from the process umask rather than chmod'ing each one, since a file the group cannot reach is no more useful than one it cannot read. Only the group bits are touched; the world bits and ownership stay with the umask as before. Mirror files written before this are repaired on the next pass. Their mtimes are correct, so no other part of the pass would revisit them, and topping up the mode costs a stat rather than a re-encode.	2026-08-24 11:36:08 +01:00