runspec-linux-core 0.3.3__tar.gz → 0.3.5__tar.gz

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.5}/CHANGELOG.md

@@ -1,5 +1,42 @@
 # runspec-linux-core Changelog
 
+## [0.3.5] — 2026-07-08
+
+Apply the same umask-neutralising treatment to `install_into_venv` that `0.3.4`
+added to `create_venv`. After the `pip install`, the venv tree is now
+normalised with `chmod -R u=rwX,go=rX <venv>` so pip's new directories are
+`755` regardless of the caller's umask.
+
+The trigger was a `sudo pip install --upgrade runspec-linux` under a host
+where sudo/PAM had switched to a `027` login umask: pip's new
+`site-packages/runspec_linux/` and `site-packages/runspec_linux_core/`
+directories landed at `750`, and `runspec local` (walking `.dist-info` via
+`importlib.metadata`) stopped seeing the packs for any user but the owner.
+The equivalent bug for the venv root was fixed at build time in `0.3.4`; this
+release closes the same gap at upgrade time.
+
+If `<venv>/logs` exists (created by `create_venv`), its `2775` setgid mode is
+restored after the wide chmod — the `test -d` guard skips the restore for a
+venv built some other way. When `run_as` is set the new steps escalate too.
+
+## [0.3.4] — 2026-07-07
+
+Fix `create_venv` producing an unreadable `750` venv directory when the caller's
+umask is `027` (typical under `sudo -n -u <svc>` with a PAM-set login umask).
+`python -m venv` honours the current umask, so a shared service-account venv
+was landing owner-only instead of the `755` a stock `python -m venv <dest>`
+produces under the default `022` umask, locking every non-owner console out —
+contrary to the "shared between several consoles" use case the helper is built
+for.
+
+After the venv-creation step, `create_venv` now runs
+`chmod -R u=rwX,go=rX <dest>` to normalise the tree to `755` on directories and
+`644` on files while preserving the `+x` on real executables in `bin/` (capital
+`X` only sets execute on directories and files that already have some execute
+bit). The subsequent `chmod 2775 <dest>/logs` still gets the last word on the
+logs directory, and `chgrp -R <group>` (when passed) still runs. When `run_as`
+is set the new chmod runs as that user too.
+
 ## [0.3.3] — 2026-06-22
 
 Add `commands.py` — the pure logic behind the new `runspec-linux` `which`

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.5}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: runspec-linux-core
-Version: 0.3.3
+Version: 0.3.5
 Summary: Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Provides-Extra: dev
 Requires-Dist: mypy; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.5}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux-core"
-version = "0.3.3"
+version = "0.3.5"
 requires-python = ">=3.10"
 description = "Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)"
 dependencies = []
 
 [project.optional-dependencies]
 dev = [
-    "ruff",
+    "ruff==0.15.20",
     "mypy",
     "pytest>=8.0",
 ]

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.5}/runspec_linux_core/venvs.py

@@ -92,12 +92,17 @@ def create_venv(
 ) -> dict:
     """Create a virtualenv at ``dest`` from a specific ``python`` interpreter.
 
-    Always uses ``--symlinks``. Then creates ``<dest>/logs`` mode ``2775`` (setgid,
-    so new audit-log files inherit the directory's group) and, if ``group`` is set,
-    ``chgrp -R`` the venv to it — enabling a shared service-account venv that several
-    consoles read/write. With ``run_as`` set every step runs as that user (so the
-    venv is owned by it). Raises ValueError on a non-executable interpreter / bad
-    name, or CommandError on a failed step.
+    Always uses ``--symlinks``. Then normalises the tree to ``u=rwX,go=rX`` so
+    directories are ``755`` and executables in ``bin/`` keep their ``+x`` — matching
+    what a plain ``python -m venv`` produces under a default ``022`` umask, regardless
+    of the caller's umask (``sudo -n -u <svc>`` often lands at ``027``, which would
+    otherwise leave the venv at ``750`` and lock other consoles out). Then creates
+    ``<dest>/logs`` mode ``2775`` (setgid, so new audit-log files inherit the
+    directory's group) and, if ``group`` is set, ``chgrp -R`` the venv to it —
+    enabling a shared service-account venv that several consoles read/write. With
+    ``run_as`` set every step runs as that user (so the venv is owned by it). Raises
+    ValueError on a non-executable interpreter / bad name, or CommandError on a
+    failed step.
     """
     if not (os.path.isfile(python) and os.access(python, os.X_OK)):
         raise ValueError(f"not an executable file: {python!r} (pick a real interpreter, not the system default)")
@@ -114,6 +119,8 @@ def create_venv(
 
     _check(_run(_become([python, "-m", "venv", *flags, dest], run_as, become_method)), "venv creation", run_as)
 
+    _check(_run(_become(["chmod", "-R", "u=rwX,go=rX", dest], run_as, become_method)), "chmod venv", run_as)
+
     logs_dir = os.path.join(dest, "logs")
     _check(_run(_become(["mkdir", "-p", logs_dir], run_as, become_method)), "logs dir", run_as)
     if group:
@@ -150,6 +157,14 @@ def install_into_venv(
     path to a directory with a ``pyproject.toml`` (or a wheel/sdist), installed
     editable when ``editable`` is set. At least one of ``packages``/``project`` is
     required. Raises ValueError on bad input, CommandError on a failed install.
+
+    After the install, the venv tree is normalised to ``u=rwX,go=rX`` (the same
+    step ``create_venv`` runs at build time) so pip's new directories are ``755``
+    regardless of the caller's umask — a ``sudo`` upgrade under a PAM-set ``027``
+    login umask otherwise lands site-packages entries at ``750`` and hides the
+    packs from ``runspec local`` / ``importlib.metadata`` for anyone but the
+    owner. If ``<venv>/logs`` exists (``create_venv`` leaves it there), its
+    ``2775`` setgid mode is restored after the wide chmod strips it.
     """
     from runspec_linux_core.packages import _validate_packages
 
@@ -180,6 +195,12 @@ def install_into_venv(
     cmd = _become([venv_python, "-m", "pip", "install", *opts, *target], run_as, become_method)
     result = _run(cmd)
     _check(result, "pip install", run_as)
+
+    _check(_run(_become(["chmod", "-R", "u=rwX,go=rX", venv], run_as, become_method)), "chmod venv", run_as)
+    logs_dir = os.path.join(venv, "logs")
+    if _run(_become(["test", "-d", logs_dir], run_as, become_method)).returncode == 0:
+        _check(_run(_become(["chmod", "2775", logs_dir], run_as, become_method)), "chmod logs", run_as)
+
     return {
         "venv": venv,
         "packages": names,

{runspec_linux_core-0.3.3 → runspec_linux_core-0.3.5}/tests/test_venvs.py

@@ -69,9 +69,12 @@ def test_create_venv_uses_symlinks_and_logs(monkeypatch: pytest.MonkeyPatch) ->
     venv_cmd = calls[0]
     assert venv_cmd[:4] == [sys.executable, "-m", "venv", "--symlinks"]
     assert venv_cmd[-1] == "/opt/v1"
+    # chmod -R u=rwX,go=rX normalises the tree to 755-dirs/644-files regardless of
+    # the caller's umask (a sudo -u <svc> shell often lands at 027 → 750).
+    assert calls[1] == ["chmod", "-R", "u=rwX,go=rX", "/opt/v1"]
     # mkdir -p logs, then chmod 2775 logs (no group → no chgrp step).
-    assert calls[1] == ["mkdir", "-p", "/opt/v1/logs"]
-    assert calls[2] == ["chmod", "2775", "/opt/v1/logs"]
+    assert calls[2] == ["mkdir", "-p", "/opt/v1/logs"]
+    assert calls[3] == ["chmod", "2775", "/opt/v1/logs"]
     assert result == {
         "python": sys.executable,
         "dest": "/opt/v1",
@@ -100,7 +103,8 @@ def test_create_venv_run_as_escalates_every_step(monkeypatch: pytest.MonkeyPatch
     venvs.create_venv(sys.executable, "/opt/v1", run_as="svc", group="consoles")
     for cmd in calls:
         assert cmd[:4] == ["sudo", "-n", "-u", "svc"]
-    # chgrp -R consoles /opt/v1 runs between mkdir and chmod.
+    # The umask-normalising chmod and the chgrp both run as svc too.
+    assert ["sudo", "-n", "-u", "svc", "chmod", "-R", "u=rwX,go=rX", "/opt/v1"] in calls
     assert ["sudo", "-n", "-u", "svc", "chgrp", "-R", "consoles", "/opt/v1"] in calls
 
 
@@ -157,6 +161,48 @@ def test_install_into_venv_editable_project(tmp_path, monkeypatch: pytest.Monkey
     assert cmd[-2:] == ["-e", str(proj)]
 
 
+def test_install_into_venv_normalises_perms(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """After the pip install, the venv tree is chmodded so sudo's umask can't hide
+    site-packages entries at 750 from `runspec local` / `importlib.metadata`."""
+    venv = _fake_venv(tmp_path, monkeypatch)
+    calls = _record(monkeypatch)
+
+    venvs.install_into_venv(venv, "httpx", upgrade=True, run_as="svc")
+
+    assert ["sudo", "-n", "-u", "svc", "chmod", "-R", "u=rwX,go=rX", venv] in calls
+    # logs_dir exists (the default stub returns 0 for `test -d`), so the setgid
+    # mode is restored after the wide chmod would have stripped it.
+    assert ["sudo", "-n", "-u", "svc", "test", "-d", f"{venv}/logs"] in calls
+    assert ["sudo", "-n", "-u", "svc", "chmod", "2775", f"{venv}/logs"] in calls
+    # And the chmod steps run *after* the pip install (order matters — pip
+    # creates the dirs we're normalising).
+    pip_i = next(i for i, c in enumerate(calls) if "pip" in c and "install" in c)
+    chmod_i = next(i for i, c in enumerate(calls) if "chmod" in c and "u=rwX,go=rX" in c)
+    assert chmod_i > pip_i
+
+
+def test_install_into_venv_skips_logs_restore_when_absent(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """A venv without a logs/ dir (not built by create_venv) gets the wide chmod
+    but no 2775 restore — the test -d guard skips the logs step."""
+    venv = _fake_venv(tmp_path, monkeypatch)
+    calls: list[list[str]] = []
+
+    def fake_run(argv: list[str]) -> subprocess.CompletedProcess:
+        calls.append(argv)
+        # Only the `test -d <venv>/logs` probe fails; everything else succeeds.
+        if argv[:2] == ["test", "-d"]:
+            return _completed(returncode=1)
+        return _completed("Successfully installed foo\n")
+
+    monkeypatch.setattr(venvs, "_run", fake_run)
+
+    venvs.install_into_venv(venv, "httpx")
+
+    assert ["chmod", "-R", "u=rwX,go=rX", venv] in calls
+    assert ["test", "-d", f"{venv}/logs"] in calls
+    assert not any(c[:2] == ["chmod", "2775"] for c in calls)
+
+
 def test_install_into_venv_requires_a_target(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
     venv = _fake_venv(tmp_path, monkeypatch)
     _record(monkeypatch)