read access on bootstrap css file

[robjhyndman]

Bug description

Under quarto 1.6.37, when generating my website (robjhyndman.com), the bootstrap-<string of characters>.min.css file that is created (within the _site/site_libs/bootstrap folder) has permissions -rw------- instead of -rw-r--r--. This means the site renders fine locally, but when uploaded to a server, it is broken (that file returns a 403 error).

I have fixed it using chmod +r on the server, but this has to be done every time I regenerate the site.

The problem didn't occur using quarto 1.5.57.

Steps to reproduce

No response

Expected behavior

No response

Actual behavior

No response

Your environment

No response

Quarto check output

Quarto 1.6.37
[✓] Checking environment information...
      Quarto cache location: /home/hyndman/.cache/quarto
[✓] Checking versions of quarto binary dependencies...
      Pandoc version 3.4.0: OK
      Dart Sass version 1.70.0: OK
      Deno version 1.46.3: OK
      Typst version 0.11.0: OK
[✓] Checking versions of quarto dependencies......OK
[✓] Checking Quarto installation......OK
      Version: 1.6.37
      Path: /opt/quarto/bin

[✓] Checking tools....................OK
      TinyTeX: (not installed)
      Chromium: (not installed)

[✓] Checking LaTeX....................OK
      Using: Installation From Path
      Path: /usr/bin
      Version: 2023

[✓] Checking basic markdown render....OK

[✓] Checking Python 3 installation....OK
      Version: 3.12.3
      Path: /usr/bin/python3
      Jupyter: (None)

      Jupyter is not available in this Python installation.
      Install with python3 -m pip install jupyter

[✓] Checking R installation...........OK
      Version: 4.4.2
      Path: /usr/lib/R
      LibPaths:
        - /home/hyndman/R/x86_64-pc-linux-gnu-library/4.4
        - /usr/local/lib/R/site-library
        - /usr/lib/R/site-library
        - /usr/lib/R/library
      knitr: 1.49
      rmarkdown: 2.29

[✓] Checking Knitr engine render......OK

[cderv]

Thanks a lot for the report. This is a change hard to detect. Took me some time to find which file rewrite was loosing original mode.

Here is what happens:

• We create some file in temp directory with Deno and this uses -rw-------. One of the file is the SCSS passed to Dart Sass
• Dart Sass will compile this to a new css file but it will change the right to -rw-r--r--. This is where it originally come from.
• In quarto 1.6 we added a cleaning step after Dart Sass compilation and this is where the mode of the file is change.

quarto-cli/src/command/render/pandoc-html.ts

Lines 536 to 545 in bf1591b

	if (dirty) {
	const cleanedCss = css.replaceAll(kVariablesRegex, "");
	let newCssPath: string | undefined;
	if (cleanedCss.trim() === "") {
	newCssPath = undefined;
	} else {
	const hash = await md5HashBytes(new TextEncoder().encode(cleanedCss));
	newCssPath = temp.createFile({ suffix: `-${hash}.css` });
	writeTextFileSyncPreserveMode(newCssPath, cleanedCss);
	}

writeTextFileSyncPreserveMode() was suppose to help keep the mode, but in fact it is not applied correctly to the original file. 🤦 This is a regression from my change in #10657 that we missed and reverted back to this error #660 ... thanks again for the report !

We'll fix that, and probably backport to 1.6 in our next patch release. To be confirmed with @cscheid.

One note though on that:

Quarto did not set on purpose the mode to be -rw-r--r-- this is all Dart SASS doing that. So changes just did not preserve the right (as Deno file creation is -rw------- by default). It was not done on purpose, but it could also have been in the sense that probably some other file created by Quarto will be -rw------- and still require chmod +r when deploying to a server 🤔

So it could also be a choice from quarto to consider +r to be the default for all file in site_libs or output-dir in general. Or an opposite choice to do nothing, and let the user do what is needed in a post render script. Probably both are valid cases...

[cscheid]

We'll fix that, and probably backport to 1.6 in our next patch release. To be confirmed with @cscheid.

This is definitely worth a backport and early patch release.

[cderv]

This was fixed in another PR

• Refactor Deno.build.os into RAL, add safeFileMode #11539

and it has been backported to v1.6. We'll do a patch release soon.