pypa / pypa/setuptools

Incorrect permissions on *.egg-info directory

Open
#1,328 5 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Needs Triage
Dominant language
Python
Stars
2.9k
Forks
1.4k
Avg merge
1d 1h
Merged PRs (30d)
1

Description

It seems that the setup.py install command doesn't set the permissions of the <package>.egg-info/* files when they already exist, relying on what is already set. As noted in https://github.com/sshuttle/sshuttle/issues/217#issuecomment-381378684, it seems many other projects suffered from the same "bug" in the last years, relying on the packager to set the permissions manually to 644 before uploading to PyPI.

Relying on the umask of the user during the package tarball creation is too error-prone, so maybe permissions should always be set automatically by setuptools.

Maybe this issue is a duplicate of https://github.com/pypa/setuptools/issues/1283, I'm not sure.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the permissions behavior described for setup.py install when <package>.egg-info/* already exists, and compare it with the related setuptools issue linked in the report. Trace where the egg-info files are created or reused. Done means permissions are set automatically rather than inherited from the user's umask, with the behavior covered by an appropriate test.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.