From 2a0b2dcc1f3ba4e6ec4f6eeb24209fff60e24cda Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Thu, 12 Nov 2026 04:24:44 +0100
Subject: [PATCH] swarm-archive vm test: the fake store is readable by the
 prune whatever the writer's umask

---
 nix/vm-tests/swarm-archive.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nix/vm-tests/swarm-archive.nix b/nix/vm-tests/swarm-archive.nix
index 7d142a428..8f7320ec0 100644
--- a/nix/vm-tests/swarm-archive.nix
+++ b/nix/vm-tests/swarm-archive.nix
@@ -31,7 +31,11 @@ let
   agentRoot = "/var/lib/hyperhive/agents";
 
   # A directory is a leaf, a file in it a field: `kv get -field=<f> <path>`.
+  # The store stays readable by every caller whatever the umask of the writer:
+  # the users unit runs with `UMask=0027` and its `kv put` creates the parent
+  # directories, which the prune (another user) must still traverse.
   fakeBao = pkgs.writeShellScriptBin "bao" ''
+    umask 022
     store=${store}
     case "$1 $2" in
       "login -method=cert") echo faketoken; exit 0 ;;