From 3a4d9e1fe2d91517d8b4c9a420ebdbd2823c133a Mon Sep 17 00:00:00 2001
From: Joe Lanford <joe.lanford@gmail.com>
Date: Fri, 17 May 2024 08:55:09 -0400
Subject: [PATCH] cache: fixup pogreb db permissions (#1317)

Signed-off-by: Joe Lanford <joe.lanford@gmail.com>
---
 pkg/cache/pogrebv1.go | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/pkg/cache/pogrebv1.go b/pkg/cache/pogrebv1.go
index 616ba720e..af5b35ddf 100644
--- a/pkg/cache/pogrebv1.go
+++ b/pkg/cache/pogrebv1.go
@@ -31,8 +31,8 @@ func newPogrebV1Backend(baseDir string) *pogrebV1Backend {
 }
 
 const (
-	pogrebV1CacheModeDir  = 0750
-	pogrebV1CacheModeFile = 0640
+	pogrebV1CacheModeDir  = 0770
+	pogrebV1CacheModeFile = 0660
 
 	pograbV1CacheDir = "pogreb.v1"
 	pogrebDigestFile = pograbV1CacheDir + "/digest"
@@ -86,7 +86,24 @@ func (q *pogrebV1Backend) Close() error {
 	if q.db == nil {
 		return nil
 	}
-	return q.db.Close()
+	if err := q.db.Close(); err != nil {
+		return err
+	}
+
+	// Recursively fixup permissions on the DB directory.
+	return filepath.Walk(filepath.Join(q.baseDir, pogrebDbDir), func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		switch info.Mode().Type() {
+		case os.ModeDir:
+			return os.Chmod(path, pogrebV1CacheModeDir)
+		case 0:
+			return os.Chmod(path, pogrebV1CacheModeFile)
+		default:
+			return nil
+		}
+	})
 }
 
 func (q *pogrebV1Backend) GetPackageIndex(_ context.Context) (packageIndex, error) {