runspec-linux-core 0.3.4__tar.gz → 0.3.5__tar.gz

{runspec_linux_core-0.3.4 → runspec_linux_core-0.3.5}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # runspec-linux-core Changelog
 
+## [0.3.5] — 2026-07-08
+
+Apply the same umask-neutralising treatment to `install_into_venv` that `0.3.4`
+added to `create_venv`. After the `pip install`, the venv tree is now
+normalised with `chmod -R u=rwX,go=rX <venv>` so pip's new directories are
+`755` regardless of the caller's umask.
+
+The trigger was a `sudo pip install --upgrade runspec-linux` under a host
+where sudo/PAM had switched to a `027` login umask: pip's new
+`site-packages/runspec_linux/` and `site-packages/runspec_linux_core/`
+directories landed at `750`, and `runspec local` (walking `.dist-info` via
+`importlib.metadata`) stopped seeing the packs for any user but the owner.
+The equivalent bug for the venv root was fixed at build time in `0.3.4`; this
+release closes the same gap at upgrade time.
+
+If `<venv>/logs` exists (created by `create_venv`), its `2775` setgid mode is
+restored after the wide chmod — the `test -d` guard skips the restore for a
+venv built some other way. When `run_as` is set the new steps escalate too.
+
 ## [0.3.4] — 2026-07-07
 
 Fix `create_venv` producing an unreadable `750` venv directory when the caller's

{runspec_linux_core-0.3.4 → runspec_linux_core-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runspec-linux-core
-Version: 0.3.4
+Version: 0.3.5
 Summary: Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Provides-Extra: dev

{runspec_linux_core-0.3.4 → runspec_linux_core-0.3.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux-core"
-version = "0.3.4"
+version = "0.3.5"
 requires-python = ">=3.10"
 description = "Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)"
 dependencies = []

{runspec_linux_core-0.3.4 → runspec_linux_core-0.3.5}/runspec_linux_core/venvs.py

@@ -157,6 +157,14 @@ def install_into_venv(
     path to a directory with a ``pyproject.toml`` (or a wheel/sdist), installed
     editable when ``editable`` is set. At least one of ``packages``/``project`` is
     required. Raises ValueError on bad input, CommandError on a failed install.
+
+    After the install, the venv tree is normalised to ``u=rwX,go=rX`` (the same
+    step ``create_venv`` runs at build time) so pip's new directories are ``755``
+    regardless of the caller's umask — a ``sudo`` upgrade under a PAM-set ``027``
+    login umask otherwise lands site-packages entries at ``750`` and hides the
+    packs from ``runspec local`` / ``importlib.metadata`` for anyone but the
+    owner. If ``<venv>/logs`` exists (``create_venv`` leaves it there), its
+    ``2775`` setgid mode is restored after the wide chmod strips it.
     """
     from runspec_linux_core.packages import _validate_packages
 
@@ -187,6 +195,12 @@ def install_into_venv(
     cmd = _become([venv_python, "-m", "pip", "install", *opts, *target], run_as, become_method)
     result = _run(cmd)
     _check(result, "pip install", run_as)
+
+    _check(_run(_become(["chmod", "-R", "u=rwX,go=rX", venv], run_as, become_method)), "chmod venv", run_as)
+    logs_dir = os.path.join(venv, "logs")
+    if _run(_become(["test", "-d", logs_dir], run_as, become_method)).returncode == 0:
+        _check(_run(_become(["chmod", "2775", logs_dir], run_as, become_method)), "chmod logs", run_as)
+
     return {
         "venv": venv,
         "packages": names,

{runspec_linux_core-0.3.4 → runspec_linux_core-0.3.5}/tests/test_venvs.py

@@ -161,6 +161,48 @@ def test_install_into_venv_editable_project(tmp_path, monkeypatch: pytest.Monkey
     assert cmd[-2:] == ["-e", str(proj)]
 
 
+def test_install_into_venv_normalises_perms(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """After the pip install, the venv tree is chmodded so sudo's umask can't hide
+    site-packages entries at 750 from `runspec local` / `importlib.metadata`."""
+    venv = _fake_venv(tmp_path, monkeypatch)
+    calls = _record(monkeypatch)
+
+    venvs.install_into_venv(venv, "httpx", upgrade=True, run_as="svc")
+
+    assert ["sudo", "-n", "-u", "svc", "chmod", "-R", "u=rwX,go=rX", venv] in calls
+    # logs_dir exists (the default stub returns 0 for `test -d`), so the setgid
+    # mode is restored after the wide chmod would have stripped it.
+    assert ["sudo", "-n", "-u", "svc", "test", "-d", f"{venv}/logs"] in calls
+    assert ["sudo", "-n", "-u", "svc", "chmod", "2775", f"{venv}/logs"] in calls
+    # And the chmod steps run *after* the pip install (order matters — pip
+    # creates the dirs we're normalising).
+    pip_i = next(i for i, c in enumerate(calls) if "pip" in c and "install" in c)
+    chmod_i = next(i for i, c in enumerate(calls) if "chmod" in c and "u=rwX,go=rX" in c)
+    assert chmod_i > pip_i
+
+
+def test_install_into_venv_skips_logs_restore_when_absent(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """A venv without a logs/ dir (not built by create_venv) gets the wide chmod
+    but no 2775 restore — the test -d guard skips the logs step."""
+    venv = _fake_venv(tmp_path, monkeypatch)
+    calls: list[list[str]] = []
+
+    def fake_run(argv: list[str]) -> subprocess.CompletedProcess:
+        calls.append(argv)
+        # Only the `test -d <venv>/logs` probe fails; everything else succeeds.
+        if argv[:2] == ["test", "-d"]:
+            return _completed(returncode=1)
+        return _completed("Successfully installed foo\n")
+
+    monkeypatch.setattr(venvs, "_run", fake_run)
+
+    venvs.install_into_venv(venv, "httpx")
+
+    assert ["chmod", "-R", "u=rwX,go=rX", venv] in calls
+    assert ["test", "-d", f"{venv}/logs"] in calls
+    assert not any(c[:2] == ["chmod", "2775"] for c in calls)
+
+
 def test_install_into_venv_requires_a_target(tmp_path, monkeypatch: pytest.MonkeyPatch) -> None:
     venv = _fake_venv(tmp_path, monkeypatch)
     _record(monkeypatch)