Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #10371 > unrolled thread

setup.py sdist permissions

Back to article view | Back to linux.debian.maint.python

Contents

  setup.py sdist permissions Brian May <bam@debian.org> - 2018-04-04 00:20 +0200
    Re: setup.py sdist permissions Yaroslav Halchenko <debian@onerussian.com> - 2018-04-04 02:20 +0200
      Re: setup.py sdist permissions Brian May <bam@debian.org> - 2018-04-04 10:10 +0200
    Re: setup.py sdist permissions Paul Wise <pabs@debian.org> - 2018-04-04 09:00 +0200

#10371 — setup.py sdist permissions

Hello,

As an upstream maintainer of certain packages on pypi, it has come to my
attention that my packages have files in the source package with
permission 600 or 700 (and my owner and group). This is most likely
because my umask is set to 077, because in general I prefer not having
all my private files world/group readable.

* Is this actually a problem for users?

* Shouldn't sdist be ignoring my umask considering it is generating
  packages for public consumption?

It seems like the only known solution is to manually set umask to 022
before calling sdist, something I am likely to forgot to do on a
continued basis.

Any ideas?
-- 
Brian May <bam@debian.org>

[toc] | [next] | [standalone]

#10372

On Wed, 04 Apr 2018, Brian May wrote:

> Hello,

> As an upstream maintainer of certain packages on pypi, it has come to my
> attention that my packages have files in the source package with
> permission 600 or 700 (and my owner and group). This is most likely
> because my umask is set to 077, because in general I prefer not having
> all my private files world/group readable.

> * Is this actually a problem for users?

> * Shouldn't sdist be ignoring my umask considering it is generating
>   packages for public consumption?

> It seems like the only known solution is to manually set umask to 022
> before calling sdist, something I am likely to forgot to do on a
> continued basis.

> Any ideas?

just anecdotal support: my umask is 077 as well, have been doing uploads
to pypi for a while, never had report from the users about any problem.
The reasons could be either it indeed doesn't matter or nobody uses my
projects ;-)

Cheers,
-- 
Yaroslav O. Halchenko
Center for Open Neuroscience     http://centerforopenneuroscience.org
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419
WWW:   http://www.linkedin.com/in/yarik        

[toc] | [prev] | [next] | [standalone]

#10374

Yaroslav Halchenko <debian@onerussian.com> writes:

> just anecdotal support: my umask is 077 as well, have been doing uploads
> to pypi for a while, never had report from the users about any problem.
> The reasons could be either it indeed doesn't matter or nobody uses my
> projects ;-)

Same here.

I just got a bug report :-(

https://github.com/sshuttle/sshuttle/issues/217

Not really sure what circumstances this causes problems, or what I
should do about it.
-- 
Brian May <bam@debian.org>

[toc] | [prev] | [next] | [standalone]

#10373

On Wed, Apr 4, 2018 at 6:09 AM, Brian May wrote:

> * Shouldn't sdist be ignoring my umask considering it is generating
>   packages for public consumption?

IMO sdist should be deterministic in the reproducible builds sense:

https://reproducible-builds.org/

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.maint.python

csiph-web