runspec-linux-core 0.3.3__tar.gz → 0.3.4__tar.gz

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.4}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # runspec-linux-core Changelog
 
+## [0.3.4] — 2026-07-07
+
+Fix `create_venv` producing an unreadable `750` venv directory when the caller's
+umask is `027` (typical under `sudo -n -u <svc>` with a PAM-set login umask).
+`python -m venv` honours the current umask, so a shared service-account venv
+was landing owner-only instead of the `755` a stock `python -m venv <dest>`
+produces under the default `022` umask, locking every non-owner console out —
+contrary to the "shared between several consoles" use case the helper is built
+for.
+
+After the venv-creation step, `create_venv` now runs
+`chmod -R u=rwX,go=rX <dest>` to normalise the tree to `755` on directories and
+`644` on files while preserving the `+x` on real executables in `bin/` (capital
+`X` only sets execute on directories and files that already have some execute
+bit). The subsequent `chmod 2775 <dest>/logs` still gets the last word on the
+logs directory, and `chgrp -R <group>` (when passed) still runs. When `run_as`
+is set the new chmod runs as that user too.
+
 ## [0.3.3] — 2026-06-22
 
 Add `commands.py` — the pure logic behind the new `runspec-linux` `which`

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.4}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: runspec-linux-core
-Version: 0.3.3
+Version: 0.3.4
 Summary: Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Provides-Extra: dev
 Requires-Dist: mypy; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.4}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux-core"
-version = "0.3.3"
+version = "0.3.4"
 requires-python = ">=3.10"
 description = "Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)"
 dependencies = []
 
 [project.optional-dependencies]
 dev = [
-    "ruff",
+    "ruff==0.15.20",
     "mypy",
     "pytest>=8.0",
 ]

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.4}/runspec_linux_core/venvs.py

@@ -92,12 +92,17 @@ def create_venv(
 ) -> dict:
     """Create a virtualenv at ``dest`` from a specific ``python`` interpreter.
 
-    Always uses ``--symlinks``. Then creates ``<dest>/logs`` mode ``2775`` (setgid,
-    so new audit-log files inherit the directory's group) and, if ``group`` is set,
-    ``chgrp -R`` the venv to it — enabling a shared service-account venv that several
-    consoles read/write. With ``run_as`` set every step runs as that user (so the
-    venv is owned by it). Raises ValueError on a non-executable interpreter / bad
-    name, or CommandError on a failed step.
+    Always uses ``--symlinks``. Then normalises the tree to ``u=rwX,go=rX`` so
+    directories are ``755`` and executables in ``bin/`` keep their ``+x`` — matching
+    what a plain ``python -m venv`` produces under a default ``022`` umask, regardless
+    of the caller's umask (``sudo -n -u <svc>`` often lands at ``027``, which would
+    otherwise leave the venv at ``750`` and lock other consoles out). Then creates
+    ``<dest>/logs`` mode ``2775`` (setgid, so new audit-log files inherit the
+    directory's group) and, if ``group`` is set, ``chgrp -R`` the venv to it —
+    enabling a shared service-account venv that several consoles read/write. With
+    ``run_as`` set every step runs as that user (so the venv is owned by it). Raises
+    ValueError on a non-executable interpreter / bad name, or CommandError on a
+    failed step.
     """
     if not (os.path.isfile(python) and os.access(python, os.X_OK)):
         raise ValueError(f"not an executable file: {python!r} (pick a real interpreter, not the system default)")
@@ -114,6 +119,8 @@ def create_venv(
 
     _check(_run(_become([python, "-m", "venv", *flags, dest], run_as, become_method)), "venv creation", run_as)
 
+    _check(_run(_become(["chmod", "-R", "u=rwX,go=rX", dest], run_as, become_method)), "chmod venv", run_as)
+
     logs_dir = os.path.join(dest, "logs")
     _check(_run(_become(["mkdir", "-p", logs_dir], run_as, become_method)), "logs dir", run_as)
     if group:

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.4}/tests/test_venvs.py

@@ -69,9 +69,12 @@ def test_create_venv_uses_symlinks_and_logs(monkeypatch: pytest.MonkeyPatch) ->
     venv_cmd = calls[0]
     assert venv_cmd[:4] == [sys.executable, "-m", "venv", "--symlinks"]
     assert venv_cmd[-1] == "/opt/v1"
+    # chmod -R u=rwX,go=rX normalises the tree to 755-dirs/644-files regardless of
+    # the caller's umask (a sudo -u <svc> shell often lands at 027 → 750).
+    assert calls[1] == ["chmod", "-R", "u=rwX,go=rX", "/opt/v1"]
     # mkdir -p logs, then chmod 2775 logs (no group → no chgrp step).
-    assert calls[1] == ["mkdir", "-p", "/opt/v1/logs"]
-    assert calls[2] == ["chmod", "2775", "/opt/v1/logs"]
+    assert calls[2] == ["mkdir", "-p", "/opt/v1/logs"]
+    assert calls[3] == ["chmod", "2775", "/opt/v1/logs"]
     assert result == {
         "python": sys.executable,
         "dest": "/opt/v1",
@@ -100,7 +103,8 @@ def test_create_venv_run_as_escalates_every_step(monkeypatch: pytest.MonkeyPatch
     venvs.create_venv(sys.executable, "/opt/v1", run_as="svc", group="consoles")
     for cmd in calls:
         assert cmd[:4] == ["sudo", "-n", "-u", "svc"]
-    # chgrp -R consoles /opt/v1 runs between mkdir and chmod.
+    # The umask-normalising chmod and the chgrp both run as svc too.
+    assert ["sudo", "-n", "-u", "svc", "chmod", "-R", "u=rwX,go=rX", "/opt/v1"] in calls
     assert ["sudo", "-n", "-u", "svc", "chgrp", "-R", "consoles", "/opt/v1"] in calls