paquette 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d2e249bb3b01d7ddc7e3b78968579b004ea9ff8862895f51cdd40f814e5ab80f
-  data.tar.gz: f7c8e608ad032792fdecfaf2b66e5f0ac975932ce028b3cfdf5066c758401799
+  metadata.gz: cad055b11059ab61aa4f330936f3f6eb8bf43256599c7cfbe836f52e5cd00ac5
+  data.tar.gz: 1571bb0d09b5c88d917ec64b16ae1161f317f372b81f0b76b24b7be3fc01fcdc
 SHA512:
-  metadata.gz: de59c104c34db56212e2c01b0f6feaab8b96f1ec8040c252784ffd4efd47c1bdba89307634617bd574a2ad4cb0558cf36ba8d54f12e75acc559e6b06ae137a07
-  data.tar.gz: ddd5a0a2353161eb730ca6ca99f91eac33e1327fbe200e14965ec0d46768845a12305442634b5b6eddd926985ab5f29d119fa1b54b094ab2afc61a07f58d7d23
+  metadata.gz: 4291dd74555ff94d70856692972e3a20f8343bce143e4acab9662ae439043da6419c643e2bb299c7508ef5b5997797d273933b7e78931775789627c174beafa0
+  data.tar.gz: 99ddfc489182b81a1e3d6ff8c876fe4a6e94720363352794f34c3688ccc0bee87bad0498c6648978bb235651fdc219d316a8898ef2cc413b8d2f0d9264b01739

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 ## Unreleased
 
+## 0.3.1
+
+- Give every file in a repacked gem the mode the source gem recorded for it. The modes used to come from the unpacked copy on disk, which carried the 0600 of the Tempfile each `.rb` file is rewritten through, and the serving process's umask for everything else — so the same gem repacked to different bytes on servers with different umasks. A file Paquette injects gets 0644; one that replaces a shipped file keeps that file's mode
+- Replace a file the source gem shipped read-only instead of failing the repack
+- Include `GemRepacker::FORMAT_VERSION` in the personalizer's cache key, so personalized gems cached by an earlier repacker are rebuilt rather than served. Every personalized gem's checksum changes with this release, and a consumer whose lockfile records one will need to refresh it
+- Keep the mode of a file in an npm tarball that `files:` replaces, instead of writing it 0644 — replacing a bin script used to leave it not executable
+- Include `NpmRepacker::FORMAT_VERSION` in the npm personalizer's cache key, so tarballs cached by an earlier repacker are rebuilt rather than served. The key changes with this release, so the npm cache starts cold once; a tarball's bytes change only where a replaced file was executable
+
 ## 0.3.0
 
 - Ship signature files that name every external type. A type sord could not resolve — `Rack::Request`, `Gem::Specification`, `File::Stat` and the like — used to land in `rbi/paquette.rbi` and `sig/paquette.rbs` as a `SORD_ERROR_` constant, which no type checker can read; those types are now root-anchored in the YARD tags and come through by name, and every constant carries a type of its own

data/lib/paquette/gem_server/gem_repacker/rooted_package.rb

@@ -1,7 +1,8 @@
 require "rubygems/package"
 
 # Gem::Package that reads the files it packs from a directory of the
-# caller's choosing instead of from the working directory, silently.
+# caller's choosing instead of from the working directory, silently, and
+# records the modes it is given instead of the ones on disk.
 # `gem build` only works because the CLI chdir's into the unpacked gem
 # first — and chdir is process-global, so a server cannot do that. Only the
 # two methods that reach outside are overridden; the .gem format itself
@@ -17,11 +18,14 @@ class Paquette::GemServer::GemRepacker::RootedPackage < Gem::Package
   # @param file_name [String] where the finished gem is written
   # @param build_time [Time] the timestamp stamped into the archive — see
   #   BuildTime for why this is a block around the build, not an argument
+  # @param modes [Hash{String => Integer}] the tar mode of every file in
+  #   spec.files
   # @return [String] file_name
-  def self.build(spec, root, file_name, build_time:)
+  def self.build(spec, root, file_name, build_time:, modes:)
     Paquette::GemServer::GemRepacker::BuildTime.with(build_time) do
       package = new(file_name, nil)
       package.root = root
+      package.modes = modes
       package.spec = spec
       package.build(true)
     end
@@ -32,8 +36,12 @@ class Paquette::GemServer::GemRepacker::RootedPackage < Gem::Package
   # @return [String]
   attr_accessor :root
 
-  # The RubyGems original with @root joined onto every path it looks at. The
-  # names written into the tar stay relative, which is what a .gem holds.
+  # @return [Hash{String => Integer}]
+  attr_accessor :modes
+
+  # The RubyGems original with @root joined onto every path it looks at, and
+  # each mode taken from @modes rather than from the file's stat. The names
+  # written into the tar stay relative, which is what a .gem holds.
   #
   # @param tar [::Gem::Package::TarWriter]
   # @return [void]
@@ -43,12 +51,12 @@ class Paquette::GemServer::GemRepacker::RootedPackage < Gem::Package
       stat = File.lstat(source)
 
       if stat.symlink?
-        tar.add_symlink file, File.readlink(source), stat.mode
+        tar.add_symlink file, File.readlink(source), @modes.fetch(file)
       end
 
       next unless stat.file?
 
-      tar.add_file_simple file, stat.mode, stat.size do |dst_io|
+      tar.add_file_simple file, @modes.fetch(file), stat.size do |dst_io|
         File.open source, "rb" do |src_io|
           copy_stream(src_io, dst_io)
         end

data/lib/paquette/gem_server/gem_repacker.rb

@@ -5,6 +5,7 @@ require "fileutils"
 require "digest"
 require "tmpdir"
 require "tempfile"
+require "zlib"
 require "measurometer"
 
 # Rewrites the contents of a .gem into a new, byte-reproducible .gem —
@@ -13,6 +14,19 @@ class Paquette::GemServer::GemRepacker
   autoload :BuildTime, "#{__dir__}/gem_repacker/build_time"
   autoload :RootedPackage, "#{__dir__}/gem_repacker/rooted_package"
 
+  # Bumped whenever the same source gem and the same arguments would repack
+  # into different bytes, so a cache keyed on the inputs can include it.
+  # 2: file modes come from the source gem rather than the unpacked copy.
+  #
+  # @return [Integer]
+  FORMAT_VERSION = 2
+
+  # What `gem build` records for a plain file on a umask-022 machine, given
+  # to a file the source gem did not have.
+  #
+  # @return [Integer]
+  INJECTED_FILE_MODE = 0o100644
+
   # One-shot convenience for {#initialize} + {#repack}.
   #
   # @param gem_path [String]
@@ -42,6 +56,7 @@ class Paquette::GemServer::GemRepacker
     @into = into
     @temp_dir = nil
     @unpacked_gem_dir = nil
+    @entry_modes = nil
   end
 
   # Four subprocess-and-disk stages, each timed separately: a repack that
@@ -80,6 +95,7 @@ class Paquette::GemServer::GemRepacker
     Measurometer.instrument("paquette.gem_repacker.gem_unpack") do
       package.extract_files(@gem_dir)
     end
+    @entry_modes = source_entry_modes
   rescue Gem::Exception => e
     raise "Failed to unpack gem: #{@gem_path}. Error: #{e.message}"
   end
@@ -91,12 +107,38 @@ class Paquette::GemServer::GemRepacker
     rb_files.each { |rb_file| process_ruby_file(rb_file) }
   end
 
+  # The mode of every entry in the source gem's data.tar.gz, as its packer
+  # wrote it. The repack writes these back rather than what is on disk:
+  # extraction masks each mode with this process's umask, and the .rb files
+  # are rewritten through a Tempfile created 0600, so the disk says more
+  # about the server than about the gem.
+  #
+  # @return [Hash{String => Integer}] entry name => mode
+  def source_entry_modes
+    modes = {}
+    File.open(@gem_path, "rb") do |io|
+      Gem::Package::TarReader.new(io).each do |entry|
+        next unless entry.full_name == "data.tar.gz"
+        Zlib::GzipReader.wrap(entry) do |gz|
+          Gem::Package::TarReader.new(gz).each { |file| modes[file.full_name] = file.header.mode }
+        end
+      end
+    end
+    modes
+  end
+
+  # A file that replaces one the gem shipped keeps that file's mode. Removed
+  # before it is written, because the one it replaces may have been shipped
+  # read-only.
+  #
   # @return [void]
   def inject_files
     @files.each do |file_path, content|
       full_path = File.join(@gem_dir, file_path)
       FileUtils.mkdir_p(File.dirname(full_path))
+      FileUtils.rm_f(full_path)
       File.write(full_path, content)
+      @entry_modes[file_path] ||= INJECTED_FILE_MODE
     end
   end
 
@@ -160,7 +202,8 @@ class Paquette::GemServer::GemRepacker
     Measurometer.instrument("paquette.gem_repacker.gem_build") do
       Paquette::GemServer::GemRepacker::RootedPackage.build(
         repacked_spec(original_spec), @gem_dir, final_gem_path,
-        build_time: original_spec.date
+        build_time: original_spec.date,
+        modes: @entry_modes
       )
     end
 

data/lib/paquette/gem_server/personalizer.rb

@@ -287,12 +287,15 @@ class Paquette::GemServer::Personalizer < SimpleDelegator
     File.join(@cache_dir, "#{gem_name}-#{version}-#{digest}.plain")
   end
 
-  # Everything this personalizer would write into a gem, as one short hash.
-  # Stable across processes, so a restart does not orphan the cache.
+  # Everything this personalizer would write into a gem, and the repacker
+  # format it writes it with, as one short hash. Stable across processes, so
+  # a restart does not orphan the cache; a new repacker format does, on
+  # purpose.
   #
   # @return [String]
   def personalization_digest
     @personalization_digest ||= Digest::SHA256.hexdigest([
+      Paquette::GemServer::GemRepacker::FORMAT_VERSION,
       @license_key,
       @magic_comment_replacements.sort.inspect,
       @files.sort.inspect,

data/lib/paquette/npm_repacker.rb

@@ -15,6 +15,14 @@ class Paquette::NpmRepacker
   # Raised for a marker or replacement spanning several lines.
   class MultilineReplacement < StandardError; end
 
+  # Bumped whenever the same source tarball and the same arguments would
+  # repack into different bytes, so a cache keyed on the inputs can include
+  # it — the counterpart of GemServer::GemRepacker::FORMAT_VERSION.
+  # 2: a file that replaces a shipped one keeps that file's mode.
+  #
+  # @return [Integer]
+  FORMAT_VERSION = 2
+
   # Binary assets and sourcemaps are copied through untouched.
   #
   # @return [Array<String>]
@@ -203,7 +211,8 @@ class Paquette::NpmRepacker
   end
 
   # Injected files inherit the package's oldest mtime, keeping the tarball
-  # independent of when they were added.
+  # independent of when they were added. One that replaces a shipped file
+  # keeps that file's mode, so replacing a bin script leaves it executable.
   #
   # @param entries [Array<Paquette::Tarball::Entry>]
   # @param root [String]
@@ -216,7 +225,8 @@ class Paquette::NpmRepacker
 
     @files.each do |relative_path, content|
       name = "#{root}/#{relative_path}"
-      by_name[name] = Paquette::Tarball::Entry.new(name: name, mode: 0o644, mtime: mtime, content: content.to_s)
+      mode = by_name[name]&.mode || 0o644
+      by_name[name] = Paquette::Tarball::Entry.new(name: name, mode: mode, mtime: mtime, content: content.to_s)
     end
 
     by_name.values

data/lib/paquette/npm_server/personalizer.rb

@@ -192,11 +192,14 @@ class Paquette::NpmServer::Personalizer < SimpleDelegator
     File.join(@cache_dir, "#{File.basename(package_name)}-#{version}-#{digest}.plain")
   end
 
-  # Stable across processes, so a restart does not orphan the cache.
+  # Everything this personalizer would write into a tarball, and the
+  # repacker format it writes it with. Stable across processes, so a restart
+  # does not orphan the cache; a new repacker format does, on purpose.
   #
   # @return [String]
   def personalization_digest
     @personalization_digest ||= Digest::SHA256.hexdigest([
+      Paquette::NpmRepacker::FORMAT_VERSION,
       @license_key,
       @magic_comment_replacements.sort.inspect,
       @files.sort.inspect,

data/lib/paquette/version.rb

@@ -1,4 +1,4 @@
 module Paquette
   # @return [String]
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

data/rbi/paquette.rbi

@@ -5,7 +5,7 @@
 module Paquette
   DEFAULT_REGEXP_TIMEOUT = T.let(0.05, T.untyped)
   MAX_PUSH_SIZE_BYTES = T.let(50 * 1024 * 1024, T.untyped)
-  VERSION = T.let("0.3.0", T.untyped)
+  VERSION = T.let("0.3.1", T.untyped)
 
   class << self
     # The regexp timeout every Rack app in this gem installs for the duration
@@ -1078,6 +1078,9 @@ module Paquette
     # Rewrites the contents of a .gem into a new, byte-reproducible .gem —
     # replacing magic comment lines, merging gemspec metadata and injecting files.
     class GemRepacker
+      FORMAT_VERSION = T.let(2, T.untyped)
+      INJECTED_FILE_MODE = T.let(0o100644, T.untyped)
+
       # One-shot convenience for {#initialize} + {#repack}.
       # 
       # _@param_ `gem_path`
@@ -1138,6 +1141,19 @@ module Paquette
       sig { void }
       def process_ruby_files; end
 
+      # The mode of every entry in the source gem's data.tar.gz, as its packer
+      # wrote it. The repack writes these back rather than what is on disk:
+      # extraction masks each mode with this process's umask, and the .rb files
+      # are rewritten through a Tempfile created 0600, so the disk says more
+      # about the server than about the gem.
+      # 
+      # _@return_ — entry name => mode
+      sig { returns(T::Hash[String, Integer]) }
+      def source_entry_modes; end
+
+      # A file that replaces one the gem shipped keeps that file's mode. Removed
+      # before it is written, because the one it replaces may have been shipped
+      # read-only.
       sig { void }
       def inject_files; end
 
@@ -1190,7 +1206,8 @@ module Paquette
       end
 
       # Gem::Package that reads the files it packs from a directory of the
-      # caller's choosing instead of from the working directory, silently.
+      # caller's choosing instead of from the working directory, silently, and
+      # records the modes it is given instead of the ones on disk.
       # `gem build` only works because the CLI chdir's into the unpacked gem
       # first — and chdir is process-global, so a server cannot do that. Only the
       # two methods that reach outside are overridden; the .gem format itself
@@ -1209,19 +1226,23 @@ module Paquette
         # 
         # _@param_ `build_time` — the timestamp stamped into the archive — see BuildTime for why this is a block around the build, not an argument
         # 
+        # _@param_ `modes` — the tar mode of every file in spec.files
+        # 
         # _@return_ — file_name
         sig do
           params(
             spec: ::Gem::Specification,
             root: String,
             file_name: String,
-            build_time: Time
+            build_time: Time,
+            modes: T::Hash[String, Integer]
           ).returns(String)
         end
-        def self.build(spec, root, file_name, build_time:); end
+        def self.build(spec, root, file_name, build_time:, modes:); end
 
-        # The RubyGems original with @root joined onto every path it looks at. The
-        # names written into the tar stay relative, which is what a .gem holds.
+        # The RubyGems original with @root joined onto every path it looks at, and
+        # each mode taken from @modes rather than from the file's stat. The names
+        # written into the tar stay relative, which is what a .gem holds.
         # 
         # _@param_ `tar`
         sig { params(tar: ::Gem::Package::TarWriter).void }
@@ -1234,6 +1255,9 @@ module Paquette
 
         sig { returns(String) }
         attr_accessor :root
+
+        sig { returns(T::Hash[String, Integer]) }
+        attr_accessor :modes
       end
     end
 
@@ -1400,8 +1424,10 @@ module Paquette
       sig { params(gem_name: String, version: String, stat: ::File::Stat).returns(String) }
       def plain_marker_path(gem_name, version, stat); end
 
-      # Everything this personalizer would write into a gem, as one short hash.
-      # Stable across processes, so a restart does not orphan the cache.
+      # Everything this personalizer would write into a gem, and the repacker
+      # format it writes it with, as one short hash. Stable across processes, so
+      # a restart does not orphan the cache; a new repacker format does, on
+      # purpose.
       sig { returns(String) }
       def personalization_digest; end
     end
@@ -2766,7 +2792,9 @@ module Paquette
       sig { params(package_name: String, version: String, stat: ::File::Stat).returns(String) }
       def plain_marker_path(package_name, version, stat); end
 
-      # Stable across processes, so a restart does not orphan the cache.
+      # Everything this personalizer would write into a tarball, and the
+      # repacker format it writes it with. Stable across processes, so a restart
+      # does not orphan the cache; a new repacker format does, on purpose.
       sig { returns(String) }
       def personalization_digest; end
     end
@@ -3252,6 +3280,7 @@ module Paquette
   # GemServer::GemRepacker, with `package_json_extras:` for `gemspec_extras`.
   # Byte-reproducible — see Paquette::Tarball for why that is load-bearing.
   class NpmRepacker
+    FORMAT_VERSION = T.let(2, T.untyped)
     SOURCE_EXTENSIONS = T.let(%w[.js .mjs .cjs .jsx .ts .tsx .mts .cts].freeze, T.untyped)
 
     # One line in, one line out — the rule the whole personalization scheme
@@ -3353,7 +3382,8 @@ module Paquette
     def apply_package_json_extras(entries, root); end
 
     # Injected files inherit the package's oldest mtime, keeping the tarball
-    # independent of when they were added.
+    # independent of when they were added. One that replaces a shipped file
+    # keeps that file's mode, so replacing a bin script leaves it executable.
     # 
     # _@param_ `entries`
     # 

data/sig/paquette.rbs

@@ -938,6 +938,9 @@ module Paquette
     # Rewrites the contents of a .gem into a new, byte-reproducible .gem —
     # replacing magic comment lines, merging gemspec metadata and injecting files.
     class GemRepacker
+      FORMAT_VERSION: Integer
+      INJECTED_FILE_MODE: Integer
+
       # One-shot convenience for {#initialize} + {#repack}.
       # 
       # _@param_ `gem_path`
@@ -988,6 +991,18 @@ module Paquette
 
       def process_ruby_files: () -> void
 
+      # The mode of every entry in the source gem's data.tar.gz, as its packer
+      # wrote it. The repack writes these back rather than what is on disk:
+      # extraction masks each mode with this process's umask, and the .rb files
+      # are rewritten through a Tempfile created 0600, so the disk says more
+      # about the server than about the gem.
+      # 
+      # _@return_ — entry name => mode
+      def source_entry_modes: () -> ::Hash[String, Integer]
+
+      # A file that replaces one the gem shipped keeps that file's mode. Removed
+      # before it is written, because the one it replaces may have been shipped
+      # read-only.
       def inject_files: () -> void
 
       # _@param_ `file_path`
@@ -1032,7 +1047,8 @@ module Paquette
       end
 
       # Gem::Package that reads the files it packs from a directory of the
-      # caller's choosing instead of from the working directory, silently.
+      # caller's choosing instead of from the working directory, silently, and
+      # records the modes it is given instead of the ones on disk.
       # `gem build` only works because the CLI chdir's into the unpacked gem
       # first — and chdir is process-global, so a server cannot do that. Only the
       # two methods that reach outside are overridden; the .gem format itself
@@ -1051,16 +1067,20 @@ module Paquette
         # 
         # _@param_ `build_time` — the timestamp stamped into the archive — see BuildTime for why this is a block around the build, not an argument
         # 
+        # _@param_ `modes` — the tar mode of every file in spec.files
+        # 
         # _@return_ — file_name
         def self.build: (
                           ::Gem::Specification spec,
                           String root,
                           String file_name,
-                          build_time: Time
+                          build_time: Time,
+                          modes: ::Hash[String, Integer]
                         ) -> String
 
-        # The RubyGems original with @root joined onto every path it looks at. The
-        # names written into the tar stay relative, which is what a .gem holds.
+        # The RubyGems original with @root joined onto every path it looks at, and
+        # each mode taken from @modes rather than from the file's stat. The names
+        # written into the tar stay relative, which is what a .gem holds.
         # 
         # _@param_ `tar`
         def add_files: (::Gem::Package::TarWriter tar) -> void
@@ -1070,6 +1090,8 @@ module Paquette
         def say: () -> void
 
         attr_accessor root: String
+
+        attr_accessor modes: ::Hash[String, Integer]
       end
     end
 
@@ -1219,8 +1241,10 @@ module Paquette
       # _@param_ `stat`
       def plain_marker_path: (String gem_name, String version, ::File::Stat stat) -> String
 
-      # Everything this personalizer would write into a gem, as one short hash.
-      # Stable across processes, so a restart does not orphan the cache.
+      # Everything this personalizer would write into a gem, and the repacker
+      # format it writes it with, as one short hash. Stable across processes, so
+      # a restart does not orphan the cache; a new repacker format does, on
+      # purpose.
       def personalization_digest: () -> String
     end
 
@@ -2411,7 +2435,9 @@ module Paquette
       # _@param_ `stat`
       def plain_marker_path: (String package_name, String version, ::File::Stat stat) -> String
 
-      # Stable across processes, so a restart does not orphan the cache.
+      # Everything this personalizer would write into a tarball, and the
+      # repacker format it writes it with. Stable across processes, so a restart
+      # does not orphan the cache; a new repacker format does, on purpose.
       def personalization_digest: () -> String
     end
 
@@ -2820,6 +2846,7 @@ module Paquette
   # GemServer::GemRepacker, with `package_json_extras:` for `gemspec_extras`.
   # Byte-reproducible — see Paquette::Tarball for why that is load-bearing.
   class NpmRepacker
+    FORMAT_VERSION: Integer
     SOURCE_EXTENSIONS: ::Array[String]
 
     # One line in, one line out — the rule the whole personalization scheme
@@ -2906,7 +2933,8 @@ module Paquette
     def apply_package_json_extras: (::Array[Paquette::Tarball::Entry] entries, String root) -> ::Array[Paquette::Tarball::Entry]
 
     # Injected files inherit the package's oldest mtime, keeping the tarball
-    # independent of when they were added.
+    # independent of when they were added. One that replaces a shipped file
+    # keeps that file's mode, so replacing a bin script leaves it executable.
     # 
     # _@param_ `entries`
     # 

data/test/gem_server/gem_repacker_test.rb

@@ -2,6 +2,7 @@ require_relative "../test_helper"
 require "digest"
 require "rubygems/package"
 require "open3"
+require "zlib"
 
 class GemRepackerTest < Minitest::Test
   def setup
@@ -29,6 +30,59 @@ class GemRepackerTest < Minitest::Test
     File.delete(new_gem_path) if File.exist?(new_gem_path)
   end
 
+  # Every entry keeps the mode the source gem's packer gave it — not the 0600
+  # of the Tempfile the .rb files are rewritten through (a gem that installs
+  # root-owned 0600 files cannot be required by anyone else), and not the
+  # mode extraction leaves on disk after this process's umask.
+  def test_repack_keeps_the_file_modes_of_the_source_gem
+    Dir.mktmpdir("gem_repacker_permissions") do |dir|
+      source = build_gem_with_modes(dir)
+
+      [0o022, 0o077].each do |umask|
+        repacked = with_umask(umask) do
+          Paquette::GemServer::GemRepacker.repack(source,
+            magic_comment_replacements: {"# paquette_license_info" => "LIC-1"},
+            into: File.join(dir, "repacked-#{umask.to_s(8)}.gem"))
+        end
+
+        assert_equal data_entry_modes(source), data_entry_modes(repacked), "under umask #{umask.to_s(8)}"
+      end
+    end
+  end
+
+  def test_repack_is_byte_identical_whatever_the_umask
+    Dir.mktmpdir("gem_repacker_umask") do |dir|
+      source = build_gem_with_modes(dir)
+
+      digests = [0o022, 0o002, 0o077].map do |umask|
+        with_umask(umask) do
+          repacked = Paquette::GemServer::GemRepacker.repack(source,
+            files: {"LICENSE-EXTRA.txt" => "Licensed to somebody\n"},
+            into: File.join(dir, "repacked-#{umask.to_s(8)}.gem"))
+          Digest::SHA256.file(repacked).hexdigest
+        end
+      end
+
+      assert_equal 1, digests.uniq.length
+    end
+  end
+
+  def test_repack_gives_an_injected_file_a_readable_mode_and_a_replaced_one_its_old_mode
+    Dir.mktmpdir("gem_repacker_injected") do |dir|
+      source = build_gem_with_modes(dir)
+
+      repacked = with_umask(0o077) do
+        Paquette::GemServer::GemRepacker.repack(source,
+          files: {"LICENSE-EXTRA.txt" => "new\n", "data/readonly.txt" => "replaced\n"},
+          into: File.join(dir, "repacked.gem"))
+      end
+
+      modes = data_entry_modes(repacked)
+      assert_equal 0o100644, modes["LICENSE-EXTRA.txt"]
+      assert_equal data_entry_modes(source)["data/readonly.txt"], modes["data/readonly.txt"]
+    end
+  end
+
   def test_repack_with_metadata_keys
     assert File.exist?(@test_gem_path), "Test gem not found at #{@test_gem_path}"
 
@@ -326,6 +380,59 @@ class GemRepackerTest < Minitest::Test
 
   private
 
+  # A gem whose files do not all share one mode, the way a gem built on a
+  # umask-002 machine or shipping an executable arrives.
+  #
+  # @return [String] path of the built gem
+  def build_gem_with_modes(dir)
+    root = File.join(dir, "source")
+    {
+      "lib/moded.rb" => ["# paquette_license_info\nmodule Moded; end\n", 0o664],
+      "exe/moded" => ["#!/usr/bin/env ruby\n", 0o755],
+      "data/readonly.txt" => ["read me\n", 0o444],
+      "README.md" => ["# Moded\n", 0o644]
+    }.each do |path, (content, mode)|
+      full = File.join(root, path)
+      FileUtils.mkdir_p(File.dirname(full))
+      File.write(full, content)
+      File.chmod(mode, full)
+    end
+
+    spec = Gem::Specification.new do |s|
+      s.name = "moded"
+      s.version = "0.1.0"
+      s.summary = "Files with different modes"
+      s.authors = ["Paquette"]
+      s.files = ["README.md", "data/readonly.txt", "exe/moded", "lib/moded.rb"]
+    end
+    modes = spec.files.to_h { |path| [path, File.stat(File.join(root, path)).mode] }
+
+    gem_path = File.join(dir, "moded-0.1.0.gem")
+    Paquette::GemServer::GemRepacker::RootedPackage.build(spec, root, gem_path, build_time: Time.utc(2026, 1, 1), modes: modes)
+    gem_path
+  end
+
+  def with_umask(umask)
+    previous = File.umask(umask)
+    yield
+  ensure
+    File.umask(previous)
+  end
+
+  # @return [Hash{String => Integer}] tar entry name => mode, from data.tar.gz
+  def data_entry_modes(gem_path)
+    modes = {}
+    File.open(gem_path, "rb") do |io|
+      Gem::Package::TarReader.new(io).each do |entry|
+        next unless entry.full_name == "data.tar.gz"
+        Zlib::GzipReader.wrap(entry) do |gz|
+          Gem::Package::TarReader.new(gz).each { |file| modes[file.full_name] = file.header.mode }
+        end
+      end
+    end
+    modes
+  end
+
   def verify_repacking(gem_path, expected_random_chars)
     # Create a temporary directory to unpack the new gem
     temp_dir = Dir.mktmpdir("verify_repacking")

data/test/npm_repacker_test.rb

@@ -187,6 +187,46 @@ class NpmRepackerTest < Minitest::Test
     assert_equal 1, Paquette::Tarball.entries(path).count { |entry| entry.name == "package/README.md" }
   end
 
+  def test_an_injected_file_keeps_the_mode_of_the_one_it_replaces
+    source = File.join(@work_dir, "source.tgz")
+    Paquette::Tarball.write(source, [
+      Paquette::Tarball::Entry.new(name: "package/package.json", mode: 0o644, mtime: NPM_EPOCH, content: '{"name":"widget"}'),
+      Paquette::Tarball::Entry.new(name: "package/bin/cli.js", mode: 0o755, mtime: NPM_EPOCH, content: "#!/usr/bin/env node\n")
+    ])
+
+    path = Paquette::NpmRepacker.repack(source,
+      files: {"bin/cli.js" => "#!/usr/bin/env node\n// licensed\n", "LICENSE.txt" => "Licensed to Acme"}, into: into)
+
+    modes = Paquette::Tarball.entries(path).to_h { |entry| [entry.name, entry.mode] }
+    assert_equal 0o755, modes["package/bin/cli.js"]
+    assert_equal 0o644, modes["package/LICENSE.txt"]
+  end
+
+  # The tarball is rewritten in memory and never unpacked, so nothing on the
+  # way — a Tempfile, the process umask — reaches the modes it writes. The
+  # gem repacker learned that the hard way.
+  def test_repacking_is_byte_identical_whatever_the_umask
+    source = File.join(@work_dir, "source.tgz")
+    Paquette::Tarball.write(source, [
+      Paquette::Tarball::Entry.new(name: "package/package.json", mode: 0o664, mtime: NPM_EPOCH, content: '{"name":"widget"}'),
+      Paquette::Tarball::Entry.new(name: "package/index.js", mode: 0o600, mtime: NPM_EPOCH, content: "module.exports = 1;\n"),
+      Paquette::Tarball::Entry.new(name: "package/bin/cli.js", mode: 0o755, mtime: NPM_EPOCH, content: "#!/usr/bin/env node\n")
+    ])
+
+    digests = [0o022, 0o002, 0o077].map do |umask|
+      previous = File.umask(umask)
+      begin
+        path = Paquette::NpmRepacker.repack(source,
+          files: {"LICENSE.txt" => "Licensed to Acme"}, into: into("umask-#{umask.to_s(8)}.tgz"))
+        Digest::SHA256.file(path).hexdigest
+      ensure
+        File.umask(previous)
+      end
+    end
+
+    assert_equal 1, digests.uniq.length
+  end
+
   def test_repack_changes_the_checksum
     source = fixture_package
     original = Digest::SHA256.file(source).hexdigest

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: paquette
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Julik Tarkhanov
 bindir: bin
 cert_chain: []
-date: 2026-09-27 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack