private_key: rw only for owner

job_executor/adapter/fs/private_keys_directory.py

@@ -14,7 +14,17 @@ def create(self) -> bool:
         return False
 
     def save_private_key(self, microdata_private_key_pem: bytes) -> None:
-        with open(self._get_private_key_location(), "wb") as file:
+        """
+        Write the new private key file so only the owner of the
+        file (this application) has read and write permissions.
+        Fails and raises an exception if the file exists.
+        """
+        fd = os.open(
+            self._get_private_key_location(),
+            os.O_CREAT | os.O_WRONLY | os.O_EXCL,
+            0o600,
+        )
+        with os.fdopen(fd, "wb") as file:
             file.write(microdata_private_key_pem)
 
     def clean_up(self) -> bool:

pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
     "requests>=2.32.4,<3",
     "pandas>=2.2.1,<3",
     "urllib3>=2.5.0,<3",
-    "microdata-tools==1.10.3",
+    "microdata-tools==1.10.4",
 ]
 
 [dependency-groups]