Skip to content

Conversation

darwindarak
Copy link

This is a follow up to #12895, where instead of copying the reference Project.toml file, which may be read only, it was changed to write a new file. However, on my system the default write permissions seemed to still be read-only so I still ran into the same problem. This PR explicitly sets the newly written file to be user writable.

@posit-snyk-bot
Copy link
Collaborator

posit-snyk-bot commented Aug 18, 2025

🎉 Snyk checks have passed. No issues have been found so far.

security/snyk check is complete. No issues have been found. (View Details)

license/snyk check is complete. No issues have been found. (View Details)

@cscheid
Copy link
Collaborator

cscheid commented Aug 19, 2025

I don't think we want to merge this; the failure mode here can be catastrophically bad. If the file permission is different for an explicit reason that we don't know about, this line will change that. And if the reasons for changing that are related to security, then this becomes a serious problem.

I'm going to go ahead and close the PR but we can continue a discussion separately.

@cscheid cscheid closed this Aug 19, 2025
@cscheid cscheid reopened this Aug 19, 2025
@cscheid
Copy link
Collaborator

cscheid commented Aug 19, 2025

(Upon reading further, I'm reopening. I originally missed the point that this Project.toml is something coming from Quarto's internal resources) We should try to understand why you're getting different permissions in your setup.

@cscheid cscheid added this to the v1.9 milestone Aug 19, 2025
@darwindarak
Copy link
Author

Just found the issue, it was an issue on my own path configuration, it was using an old version of quarto. Sorry for the noise!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants