From d42b0676ca00a1f497b014f01d2d42daaaba40be Mon Sep 17 00:00:00 2001 From: Gabriel von Winckler Date: Thu, 5 Nov 2026 16:00:54 +0000 Subject: [PATCH] release/dist/unixpkgs: set file modes explicitly in deb and rpm packages The deb and rpm contents set no mode, so nfpm copied each file's mode from the source file on disk and the result depended on where the build ran. Since the release logic moved to OSS in fc4b25d9 (2023-02), corp builds read the configs and systemd units from the read-only Go module cache and ship them as 0444, where 1.36 shipped 0644. A checkout with umask 002 instead gives group-writable 0664 files and 0775 binaries. Set the modes explicitly, as the tarballs already do: 0755 for the binaries and 0644 for the systemd units and /etc/default/tailscaled. Configs return to 0644; binaries are unchanged. Tested by building the amd64 deb and rpm under umask 002 and 022 and checking the modes with dpkg-deb -c and rpm -qplv; package metadata is otherwise unchanged. Fixes #22202 Change-Id: I14acbd075b2f680720fdec47ce5e4e6033c363f7 Signed-off-by: Gabriel von Winckler --- release/dist/unixpkgs/pkgs.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/release/dist/unixpkgs/pkgs.go b/release/dist/unixpkgs/pkgs.go index 697acea7c..3c344f94d 100644 --- a/release/dist/unixpkgs/pkgs.go +++ b/release/dist/unixpkgs/pkgs.go @@ -219,31 +219,37 @@ func (t *debTarget) Build(b *dist.Build) ([]string, error) { Type: files.TypeFile, Source: ts, Destination: "/usr/bin/tailscale", + FileInfo: &files.ContentFileInfo{Mode: 0755}, }, &files.Content{ Type: files.TypeFile, Source: tsd, Destination: "/usr/sbin/tailscaled", + FileInfo: &files.ContentFileInfo{Mode: 0755}, }, &files.Content{ Type: files.TypeFile, Source: filepath.Join(tailscaledDir, "tailscaled.service"), Destination: "/lib/systemd/system/tailscaled.service", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, &files.Content{ Type: files.TypeFile, Source: filepath.Join(tailscaledDir, "tailscale-online.target"), Destination: "/lib/systemd/system/tailscale-online.target", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, &files.Content{ Type: files.TypeFile, Source: filepath.Join(tailscaledDir, "tailscale-wait-online.service"), Destination: "/lib/systemd/system/tailscale-wait-online.service", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, &files.Content{ Type: files.TypeConfigNoReplace, Source: filepath.Join(tailscaledDir, "tailscaled.defaults"), Destination: "/etc/default/tailscaled", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, }, 0, "deb", false, time.Time{}) if err != nil { @@ -366,31 +372,37 @@ func (t *rpmTarget) Build(b *dist.Build) ([]string, error) { Type: files.TypeFile, Source: ts, Destination: "/usr/bin/tailscale", + FileInfo: &files.ContentFileInfo{Mode: 0755}, }, &files.Content{ Type: files.TypeFile, Source: tsd, Destination: "/usr/sbin/tailscaled", + FileInfo: &files.ContentFileInfo{Mode: 0755}, }, &files.Content{ Type: files.TypeFile, Source: filepath.Join(tailscaledDir, "tailscaled.service"), Destination: "/lib/systemd/system/tailscaled.service", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, &files.Content{ Type: files.TypeFile, Source: filepath.Join(tailscaledDir, "tailscale-online.target"), Destination: "/lib/systemd/system/tailscale-online.target", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, &files.Content{ Type: files.TypeFile, Source: filepath.Join(tailscaledDir, "tailscale-wait-online.service"), Destination: "/lib/systemd/system/tailscale-wait-online.service", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, &files.Content{ Type: files.TypeConfigNoReplace, Source: filepath.Join(tailscaledDir, "tailscaled.defaults"), Destination: "/etc/default/tailscaled", + FileInfo: &files.ContentFileInfo{Mode: 0644}, }, // SELinux policy on e.g. CentOS 8 forbids writing to /var/cache. // Creating an empty directory at install time resolves this issue.