Apply deployment permissions to checkpoints

internal/cli/state_hardening_test.go

@@ -57,7 +57,6 @@ func TestRunStateSurfaceMatrix(t *testing.T) {
 						}
 					}
 					assertAnyFile(t, roots.checkpoints)
-					assertRestrictedTree(t, roots.checkpoints)
 					if debug {
 						bundle := onlyChildDir(t, roots.debug)
 						assertFile(t, filepath.Join(bundle, "summary", "invocation.json"))

internal/cli/state_permissions_unix_test.go

@@ -0,0 +1,61 @@
+//go:build linux || darwin
+
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestRunCreatesReusableGroupAccessibleCacheState(t *testing.T) {
+	previousUmask := syscall.Umask(0o007)
+	defer syscall.Umask(previousUmask)
+
+	roots := newStateTestRoots(t)
+	harness := newStateTestHarness()
+	result := runStateTest(t, roots, harness.options(), false, false, "auto")
+	if result.code != 0 {
+		t.Fatalf("initial run code=%d stderr=%q", result.code, result.stderr)
+	}
+	assertGroupAccessibleCacheTree(t, roots.plans)
+	assertGroupAccessibleCacheTree(t, roots.checkpoints)
+
+	extractCalls := harness.extractCalls
+	result = runStateTest(t, roots, harness.options(), false, true, "auto")
+	if result.code != 0 {
+		t.Fatalf("resume run code=%d stderr=%q", result.code, result.stderr)
+	}
+	if harness.extractCalls != extractCalls {
+		t.Fatalf("extract calls after reuse = %d, want %d", harness.extractCalls, extractCalls)
+	}
+}
+
+func assertGroupAccessibleCacheTree(t *testing.T, root string) {
+	t.Helper()
+	if err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		want := os.FileMode(0o660)
+		if info.IsDir() {
+			want = 0o770
+		}
+		if got := info.Mode().Perm(); got != want {
+			return &cachePermissionError{path: path, got: got, want: want}
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+type cachePermissionError struct {
+	path      string
+	got, want os.FileMode
+}
+
+func (err *cachePermissionError) Error() string {
+	return err.path + " mode mismatch"
+}