fix: set script modes in the image independent of the build umask (#113)

COPY --chmod=755 for backup.sh, check.sh and entry.sh so the image no longer depends on the build host's umask; exact structure permission checks stay. README notes the BuildKit requirement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Tobias KaupatandClaude Opus 5.5 authored and GitHub committed 2026-10-21 00:33:41 +02:00
1 parent be7d426f78
commit e5b12da948
4 files changed
+8 -7

No files matched your search

-4
View File
@@ -54,10 +54,6 @@ def sabotage_tree(tmp: Path) -> None:
if patched == lines:
raise Invalid("sabotage patch did not apply, backup.sh changed shape")
script.write_text("".join(patched))
# Dockerfile COPY has no chmod: the image only works when the file is executable.
script.chmod(script.stat().st_mode | 0o111)
if not os.access(script, os.X_OK):
raise Invalid("sabotaged backup.sh is not executable")
def red_tests(report: Path) -> tuple[set[str], set[str]]: