fix: restrict access to unsanitized intermediate rootfs archives

2026-10-13 04:53:33 +03:00
parent 36a91a2451
commit 52c1db7ef0
2 changed files with 8 additions and 1 deletions
@@ -283,7 +283,10 @@ class ImageBuildTests(unittest.TestCase):
        self.builder.run = lambda *args, **kwargs: subprocess.CompletedProcess(args, 0, 'commit\n', '')
        def pod(*args, **kwargs):
            if args[0] == 'export':
-                (artifacts / 'builder-rootfs.tar').write_bytes(b'exported fixture')
+                snapshot = artifacts / 'builder-rootfs.tar'
+                self.assertTrue(snapshot.is_file(), 'raw snapshot must be created privately before export')
+                self.assertEqual(snapshot.stat().st_mode & 0o777, 0o600)
+                snapshot.write_bytes(b'exported fixture')
            elif args[0] == 'exec' and 'configure-rootfs.sh' in args[-1]:
                for name in ('vmlinuz', 'initramfs-live.img', 'squashfs.img'):
                    (artifacts / name).write_bytes(b'artifact')