cmd/go: doesn't preserve file permissions when modifying the go.mod and go.sum files

[0intro]

What version of Go are you using (go version)?

$ go version
go version devel +af880809d8 Tue Oct 1 08:19:15 2019 +0000 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/djc/.cache/go-build"
GOENV="/home/djc/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/djc/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build325934745=/tmp/go-build -gno-record-gcc-switches"

What did you do?

$ mkdir pkg
$ cd pkg
$ go mod init example.com/m
go: creating new go.mod: module example.com/m
$ echo -e 'package pkg\nimport "golang.org/x/image/bmp"' >pkg.go
$ go get ...
go: finding golang.org/x/image latest
go: downloading golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a
go: extracting golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a
go: downloading golang.org/x/text v0.3.0
go: extracting golang.org/x/text v0.3.0
go: finding golang.org/x/tools latest
go: downloading golang.org/x/tools v0.0.0-20191001123449-8b695b21ef34
go: extracting golang.org/x/tools v0.0.0-20191001123449-8b695b21ef34
go: downloading golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
go: extracting golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
go: downloading golang.org/x/net v0.0.0-20190620200207-3b0461eec859
go: extracting golang.org/x/net v0.0.0-20190620200207-3b0461eec859
go: downloading golang.org/x/sync v0.0.0-20190423024810-112230192c58
go: extracting golang.org/x/sync v0.0.0-20190423024810-112230192c58
go: downloading golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a
go: extracting golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a
go: downloading golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7
go: extracting golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7
go: finding golang.org/x/sync latest
go: finding golang.org/x/xerrors latest
go: finding golang.org/x/text v0.3.2
go: finding golang.org/x/crypto latest
go: finding golang.org/x/sys latest
go: finding golang.org/x/net latest
go: downloading golang.org/x/crypto v0.0.0-20191001103751-88343688bb37
go: extracting golang.org/x/crypto v0.0.0-20191001103751-88343688bb37
go: downloading golang.org/x/net v0.0.0-20190930134127-c5a3c61f89f3
go: extracting golang.org/x/net v0.0.0-20190930134127-c5a3c61f89f3
go: downloading golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
go: extracting golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
go: downloading golang.org/x/sys v0.0.0-20190927073244-c990c680b611
go: extracting golang.org/x/sys v0.0.0-20190927073244-c990c680b611
go: downloading golang.org/x/text v0.3.2
go: extracting golang.org/x/text v0.3.2
# example.com/m
./pkg.go:2:8: imported and not used: "golang.org/x/image/bmp"
$ id
uid=1000(djc) gid=1000(djc) groups=1000(djc)
$ ls -l
total 12
-rw-rw-r--. 1 djc djc  467 Oct  1 16:16 go.mod
-rw-rw-r--. 1 djc djc 2938 Oct  1 16:16 go.sum
-rw-rw-r--. 1 djc djc   44 Oct  1 16:16 pkg.go
$ chmod 777 go.mod go.sum
$ ls -l
total 12
-rwxrwxrwx. 1 djc djc  467 Oct  1 16:16 go.mod
-rwxrwxrwx. 1 djc djc 2938 Oct  1 16:16 go.sum
-rw-rw-r--. 1 djc djc   44 Oct  1 16:16 pkg.go
$ su
Password: 
# go mod tidy
go: downloading golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a
go: extracting golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a
# exit
exit
$ ls -l
total 12
-rw-r--r--. 1 root root  93 Oct  1 16:17 go.mod
-rw-r--r--. 1 root root 364 Oct  1 16:17 go.sum
-rw-rw-r--. 1 djc  djc   44 Oct  1 16:16 pkg.go

What did you expect to see?

The go tool should preserves file permissions when modifying the go.mod and go.sum files.

What did you see instead?

The go tools overrides file permissions when modifying the go.mod and go.sum files.

This issue is that the WriteGoMod and WriteGoSum functions use renameio.WriteFile instead of ioutil.WriteFile.

Contrary to ioutil.WriteFile, renameio.WriteFile doesn't preserve permissions.

[andybons]

@bcmills @jayconrod

[gopherbot]

Change https://golang.org/cl/199697 mentions this issue: cmd/go: preserve file permissions when modifying go.mod and go.sum files

[serhatgiydiren]

@bcmills You mentioned using lockedfile rather than renameio while talking about on this issue. I reviewed the package and completed the implementation and also commented the sidelock block, but in the following tests creates the go.mod file 0444 then "go test" command fails with permission denied under lockedfile.Write command. Is there any special reason to create the mod file with 0444, i think we can create files with umask'd 0666. May i request your comments about the case?

/cmd/cover/cover_test.go

• TestHtmlUnformatted
• TestFuncWithDuplicateLines

[bcmills]

@serhatgiydiren, yeah, that test is just wrong. I believe it's fixed incidentally in CL 202439 (@zx2c4).

[gopherbot]

Change https://golang.org/cl/202442 mentions this issue: cmd/go: preserve file permissions when modifying go.mod and go.sum files

[gopherbot]

Change https://golang.org/cl/205637 mentions this issue: cmd/go: use lockedfile instead of renameio for go.mod and go.sum files

[gopherbot]

Change https://golang.org/cl/206142 mentions this issue: cmd/go/internal/modload: use lockedfile.Read for the initial read of the go.mod file