Skip to content

set mode 0x600 on hex credentials #5431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pushcx wants to merge 1 commit into from
Closed

set mode 0x600 on hex credentials #5431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,9 @@
an empty README.
([Giacomo Cavalieri](https://github.com/giacomocavalieri))

- When create a Hex credentials file, use mode 0600 so only the user can read it.
([Peter Bhat Harkins](https://github.com/peterbhatharkins))

### Language server

- The language server now allows extracting the start of a pipeline into a
Expand Down
4 changes: 4 additions & 0 deletions compiler-cli/src/hex/auth.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
use crate::{cli, http::HttpClient};
use ecow::EcoString;
use std::fs::Permissions;
use std::os::unix::fs::PermissionsExt;

Check failure on line 4 in compiler-cli/src/hex/auth.rs

View workflow job for this annotation

GitHub Actions / test (stable, x86_64-pc-windows-msvc) 

failed to resolve: could not find `unix` in `os`

@jtdowney jtdowney Mar 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to be a problem on non-Unix builds like Windows. You can look at

gleam/compiler-cli/src/fs.rs

Lines 319 to 338 in e40d302

#[cfg(target_family = "unix")]
pub fn make_executable(path: impl AsRef<Utf8Path>) -> Result<(), Error> {
use std::os::unix::fs::PermissionsExt;
tracing::debug!(path = ?path.as_ref(), "setting_permissions");
std::fs::set_permissions(path.as_ref(), std::fs::Permissions::from_mode(0o755)).map_err(
|e| Error::FileIo {
action: FileIoAction::UpdatePermissions,
kind: FileKind::File,
path: path.as_ref().to_path_buf(),
err: Some(e.to_string()),
},
)?;
Ok(())
}
#[cfg(not(target_family = "unix"))]
pub fn make_executable(_path: impl AsRef<Utf8Path>) -> Result<(), Error> {
Ok(())
}
for the pattern of how to do this.

use gleam_core::{
Error, Result, encryption,
error::{FileIoAction, FileKind},
Expand Down Expand Up @@ -133,6 +135,8 @@
},
};
let toml = toml::to_string(&credentials).expect("OAuth credentials TOML encoding");
let perm = Permissions::from_mode(0o600);

Check failure on line 138 in compiler-cli/src/hex/auth.rs

View workflow job for this annotation

GitHub Actions / test (stable, x86_64-pc-windows-msvc) 

no function or associated item named `from_mode` found for struct `Permissions` in the current scope

@jtdowney jtdowney Mar 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd recommend extracting this into a function, then adding tests for that function that operate on a file in a temp directory and verify that the permissions are set correctly.

std::fs::set_permissions(&path, perm)?;
crate::fs::write(&path, &toml)?;
Ok(())
}
Expand Down
8 changes: 8 additions & 0 deletions compiler-core/src/error.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,6 +562,14 @@ impl From<capnp::NotInSchema> for Error {
}
}

impl From<std::io::Error> for Error {
fn from(error: std::io::Error) -> Self {
Error::MetadataDecodeError {
error: Some(error.to_string()),
}
}
}

#[derive(Debug, PartialEq, Eq, Clone, Copy)]
pub enum InvalidProjectNameReason {
Format,
Expand Down
Loading