Repository: mitogen-hq/mitogen (language: python)

Issue:
CI: ansible_tests.py sets incorrect, world readable/writable, permissions on SSH key mitogen__has_sudo_pubkey.key
The wrong base is used when calculating the mode in
https://github.com/mitogen-hq/mitogen/blob/a35b208acdb0d6f8a9dcf3e8a0db407a59679499/.ci/ansible_tests.py#L42-L44

it should be base 8. The correct permission is `u=rw,g=,o=`, the actual result is `0o446` -> `u=r,g=r,o=rw.`
This key is only used during CI jobs, so I don't think this bug results in a security vulnerability of mitogen. The incorrect permission was introduced in commit https://github.com/mitogen-hq/mitogen/commit/06ae59702c52fc3d9ed554010a260d45733d9012#diff-2b989045c3f414fc662f679fc29531d94bfb5f614f793af91913c5dfa6b2c578R32-R34 on Aug 18 2018 when the script was converted from Bash to Python.


Discussion / hints:
The key in question is stored in git https://github.com/mitogen-hq/mitogen/blob/master/tests/data/docker/mitogen__has_sudo_pubkey.key

Fix patch:
diff --git a/docs/changelog.rst b/docs/changelog.rst
index d579544f3..85ab9d2f5 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -21,6 +21,8 @@ To avail of fixes in an unreleased version, please download a ZIP file
 In progress (unreleased)
 ------------------------
 
+* :gh:issue:`1182` CI: Fix incorrect world readable/writable file permissions
+  on SSH key ``mitogen__has_sudo_pubkey.key`` during Ansible tests.
 
 
 v0.3.16 (2024-11-05)


Test patch:
diff --git a/.ci/ansible_tests.py b/.ci/ansible_tests.py
index 62dfa8f5b..4a7bedaeb 100755
--- a/.ci/ansible_tests.py
+++ b/.ci/ansible_tests.py
@@ -41,7 +41,7 @@ def pause_if_interactive():
 
 with ci_lib.Fold('job_setup'):
     os.chdir(TESTS_DIR)
-    os.chmod('../data/docker/mitogen__has_sudo_pubkey.key', int('0600', 7))
+    os.chmod('../data/docker/mitogen__has_sudo_pubkey.key', int('0600', 8))
 
     ci_lib.run("mkdir %s", HOSTS_DIR)
     for path in glob.glob(TESTS_DIR + '/hosts/*'):
diff --git a/tests/ansible/integration/ssh/variables.yml b/tests/ansible/integration/ssh/variables.yml
index 541b29f9c..51783881b 100644
--- a/tests/ansible/integration/ssh/variables.yml
+++ b/tests/ansible/integration/ssh/variables.yml
@@ -13,11 +13,6 @@
       -o "ControlPath /tmp/mitogen-ansible-test-{{18446744073709551615|random}}"
 
   tasks:
-    - name: setup ansible_ssh_private_key_file
-      shell: chmod 0600 ../data/docker/mitogen__has_sudo_pubkey.key
-      args:
-        chdir: ../..
-
     - name: ansible_user, ansible_ssh_private_key_file
       shell: >
         ANSIBLE_ANY_ERRORS_FATAL=false
@@ -34,6 +29,7 @@
       args:
         chdir: ../..
       register: out
+      changed_when: false
 
     - name: ansible_user, wrong ansible_ssh_private_key_file
       shell: >
@@ -52,6 +48,7 @@
       args:
         chdir: ../..
       register: out
+      changed_when: false
       ignore_errors: true
 
     - assert: