vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-c0re, hivectl: make the htpasswd and wg key tests fail on the in-place write

Browse source 
The htpasswd test now seeds the temp path at 0600, so only the explicit
chmod on the temp yields 0644. The wg test blocks the temp path with a
directory and asserts the write fails with the existing key untouched,
which an in-place write cannot satisfy.
This commit is contained in:
atlas 2026-10-09 16:22:34 +02:00 • committed by mara
commit dd172d9cf8
2 changed files with 21 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

13
hive-c0re/src/gateway_nginx.rs
View file

@ -406,14 +406,17 @@ mod tests {
use super::*;
use crate::lifecycle::MANAGER_NAME;
/// The htpasswd file is published `0644` whatever the umask, holds the
/// lines newline-terminated, and leaves no temp file beside it.
/// The htpasswd file is published `0644` even when the temp file it is
/// written through already exists at `0600` (opening an existing file
/// keeps its mode), holds the lines newline-terminated, and leaves no
/// temp file beside it.
#[test]
fn htpasswd_is_written_0644_with_no_temp_left() {
fn htpasswd_is_published_0644_over_a_private_leftover_tmp() {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("htpasswd");
std::fs::write(&path, "stale\n").expect("seed");
std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).expect("chmod");
let tmp = path.with_extension("htpasswd.tmp");
std::fs::write(&tmp, "leftover\n").expect("seed tmp");
std::fs::set_permissions(&tmp, std::fs::Permissions::from_mode(0o600)).expect("chmod");
htpasswd_write_at(&path, &["a:x".to_owned(), "b:y".to_owned()]).expect("write");