Review of the staging-mode fix found two regressions in the atomic writer:
- A replacement now carries over the replaced file's owner as well as its
mode. Keeping a 0600 or 0640 mode without the owner left a root-run save
of another user's file unreadable to that user.
- The streamed upload branch reopens its staging file to sync it, which a
read-only creation mode refuses for a non-root process. The owner write
bit is set at creation and the real mode is applied before publication.
The mesh documentation now says the evidence applies to every compose file
of the stack, including a hand-authored override or a Git source's files.
Anso
4cadd5d49a