From: Dmitri Goutnik <dgoutnik@gmail.com>
Date: Sat, 7 May 2022 21:10:16 +0000 (-0500)
Subject: cmd/go: make module .zip files group/world readable
X-Git-Tag: go1.19rc1~77
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=2a3b467d5f8de04a3493b7ab8cd886e109bd9283;p=gostls13.git

cmd/go: make module .zip files group/world readable

os.CreateTemp in downloadZip leaves downloaded .zip files readable only
by the owner. Make them group/world readable.

Fixes #52765

Change-Id: Iace13e4ad813201a533a1a5fc0c6d9b2e5349a42
Reviewed-on: https://go-review.googlesource.com/c/go/+/404854
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Bryan Mills <bcmills@google.com>
---

diff --git a/src/cmd/go/internal/modfetch/fetch.go b/src/cmd/go/internal/modfetch/fetch.go
index 426df9bc04..2e8c4c8aca 100644
--- a/src/cmd/go/internal/modfetch/fetch.go
+++ b/src/cmd/go/internal/modfetch/fetch.go
@@ -242,7 +242,7 @@ func downloadZip(ctx context.Context, mod module.Version, zipfile string) (err e
 	// contents of the file (by hashing it) before we commit it. Because the file
 	// is zip-compressed, we need an actual file — or at least an io.ReaderAt — to
 	// validate it: we can't just tee the stream as we write it.
-	f, err := os.CreateTemp(filepath.Dir(zipfile), tmpPattern)
+	f, err := tempFile(filepath.Dir(zipfile), filepath.Base(zipfile), 0666)
 	if err != nil {
 		return err
 	}