twpayne / chezmoi

Describe the bug

When ~/.config/chezmoi/chezmoi.toml already exists in the target directory, but its template does not yet exist in the source directory, and one then runs chezmoi edit-config-template, then the config template in the source directory is created with world-writable permissions. This happens even with an umask of e.g. 022.

To reproduce

Ensure .chezmoi.toml.tmpl does not exist in the source directory.
Ensure ~/.config/chezmoi/chezmoi.toml does exist in the target directory.
Ensure umask removes world-writable permissions.
Run: chezmoi edit-config-template, and save the file.

Observe that .chezmoi.toml.tmpl in the source directory now has world-writable permissions:

-rw-rw-rw- 1 tilman tilman 275 27. Mai 18:19 /home/tilman/.local/share/chezmoi/.chezmoi.toml.tmpl

Expected behavior

.chezmoi.toml.tmpl in the source directory should have secure permissions: It should not be world-writable, just like its rendered version in the target directory.

Output of command with the `--verbose` flag

$ chezmoi edit-config-template --verbose --no-pager
diff --git a/ b/
old mode 40755
new mode 40777
diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl
new file mode 100666
index 0000000000000000000000000000000000000000..ae616fe89038d1e735b72546b1140266d083e99a
--- /dev/null
+++ b/.chezmoi.toml.tmpl
@@ -0,0 +1,12 @@
+# ~/.config/chezmoi/chezmoi.toml
+# vim: tw=79
+#
+# See: https://www.chezmoi.io/reference/configuration-file
+#
+# Adheres to TOML v1 syntax: https://toml.io/en/v1.0.0
+
+encryption = "gpg"
+gpg.recipient = "[REDACTED]"
+
+[git]
+autoAdd = true

Output of `chezmoi doctor`

I ran this after the steps used to reproduce the bug, but running it before gives the same output.

$ chezmoi doctor
RESULT    CHECK                       MESSAGE
warning   version                     v2.48.1, built at 2024-05-13T12:57:01Z
ok        latest-version              v2.48.1
ok        os-arch                     linux/amd64 (Arch Linux)
ok        uname                       Linux gumshoe 6.9.2-arch1-1 #1 SMP PREEMPT_DYNAMIC Sun, 26 May 2024 01:30:29 +0000 x86_64 GNU/Linux
ok        go-version                  go1.22.3 (gc)
ok        executable                  /usr/bin/chezmoi
ok        config-file                 ~/.config/chezmoi/chezmoi.toml, last modified 2024-05-27T17:43:40+02:00
warning   source-dir                  ~/.local/share/chezmoi is a git working tree (dirty)
ok        suspicious-entries          no suspicious entries
warning   working-tree                ~/.local/share/chezmoi is a git working tree (dirty)
ok        dest-dir                    ~ is a directory
ok        umask                       022
ok        cd-command                  found /bin/zsh
ok        cd-args                     /bin/zsh
info      diff-command                not set
ok        edit-command                found /usr/bin/vim
ok        edit-args                   /usr/bin/vim
ok        git-command                 found /usr/bin/git, version 2.45.1
ok        merge-command               found /usr/bin/vimdiff
ok        shell-command               found /bin/zsh
ok        shell-args                  /bin/zsh
info      age-command                 age not found in $PATH
ok        gpg-command                 found /usr/bin/gpg, version 2.4.5
info      pinentry-command            not set
ok        1password-command           found ~/bin/op, version 2.29.0
info      bitwarden-command           bw not found in $PATH
info      bitwarden-secrets-command   bws not found in $PATH
info      dashlane-command            dcli not found in $PATH
info      doppler-command             doppler not found in $PATH
info      gopass-command              gopass not found in $PATH
info      keepassxc-command           keepassxc-cli not found in $PATH
info      keepassxc-db                not set
info      keeper-command              keeper not found in $PATH
info      lastpass-command            lpass not found in $PATH
info      pass-command                pass not found in $PATH
info      passhole-command            ph not found in $PATH
info      rbw-command                 rbw not found in $PATH
info      vault-command               vault not found in $PATH
info      vlt-command                 vlt not found in $PATH
info      secret-command              not set

Additional context

Only tested with the .toml template, but I'd assume this applies to any configuration language.

The issue appears to be:

chezmoi/internal/cmd/editconfigtemplatecmd.go

Line 50 in 8f72b73

    
           if err := c.sourceSystem.WriteFile(configTemplateAbsPath, data, 0o666); err != nil {

A bit of digging reveals this completely ignores the umask, and uses the permissions exactly as specified:

chezmoi/internal/chezmoi/realsystem_unix.go

Lines 134 to 137 in 8f72b73

    
           // Set permissions after truncation but before writing any data, in case the 
        
           // file contained private data before, but before writing the new contents, 
        
           // in case the new contents contain private data after. 
        
           if err = f.Chmod(perm); err != nil {

Thanks for the thorough report! Your analysis was correct. This, and an equivalent bug in chezmoi edit are fixed in #3782.

	// Set permissions after truncation but before writing any data, in case the
	// file contained private data before, but before writing the new contents,
	// in case the new contents contain private data after.
	if err = f.Chmod(perm); err != nil {

`chezmoi edit-config-template` creates initial template with world-writable permissions