Permissions on artifacts changed with version 3.75.0 of Buildkite agent

Pipelines
1

Hi.

I upgraded our Buildkite agent from 3.74.1 to 3.75.0, and it produced Docker images for our apps that caused an outage because the container runs as an unprivileged user, while the files in the image were owned by root.
Previously the permissions on the files were 0644 but on the new agent they are 0600.
e.g.
Run on an old image produced by 3.74.1:

www-data@483f8a0bcd01:~/html$ ls -l public/admin/config/mandrill/offplatform-confirmation.html
-rw-r--r-- 1 root root 41291 Jul 19 05:03 public/admin/config/mandrill/offplatform-confirmation.html

New image produced by 3.75.0

www-data@27cc42d4220f:~/html$ ls -l public/admin/config/mandrill/offplatform-confirmation.html
-rw------- 1 root root 41291 Jul 19 05:49 public/admin/config/mandrill/offplatform-confirmation.html

We’ll fix our pipelines up, but mentioning this as it may catch out others.

1 Like
2

Hi @Jim,

Thanks for bringing this to our attention. Are you able to send out a build url to support@buildkite.com so we can investigate further?

Cheers!

3

Thanks Lizette

Email sent.

4

For a bit more info here.
We had a step producing artifacts like so:

  - label: 'Upload mjml html to artifacts'
    agents:
      docker: 'true'
      queue: build
    artifact_paths:
      - "public/admin/config/mandrill/*.html"
    command: .buildkite/mjml-to-html.sh
    key: upload_mjml_html
    plugins:
      - docker-compose#v4.16.0:
          cli-version: 2
          collapse-run-log-group: true
          dependencies: false
          run: node
      - ecr#v2.7.0:
          login: true

And then downloading them here:

  - label: ':docker: Docker build :php:'
    agents:
      docker: 'true'
      queue: build
    key: build_docker_php_image
    plugins:
      - artifacts#v1.9.2:
          download: "public/admin/config/mandrill/*.html"
      - docker-compose#v4.16.0:
          cli-version: 2
          push:
            - nginx_php_fpm:$ECR_REPO_URL:$BUILDKITE_BRANCH-nginx-php-fpm
            - nginx_php_fpm:$ECR_REPO_URL:$DOCKER_BUILD_TAG-nginx-php-fpm
            - php_cli:$ECR_REPO_URL:$BUILDKITE_BRANCH-php-cli
            - php_cli:$ECR_REPO_URL:$DOCKER_BUILD_TAG-php-cli
      - ecr#v2.7.0:
          login: true

The Dockerfile used by the build step uses COPY . /var/www/html/ as one of its steps.

5

I guess it was the change here:

It used to use os.Create() to create the file which uses the current UMASK on the system combined with 0666 to determine file permissions; but the new version uses os.CreateTemp() which will lock permissions down on the temporary file and path so that only the user can read it, hence the loss of group and world permission bits on the final file.

6

Hello, @Jim! Thank you for pointing out the change that could be the cause if this issue. We will take a closer look there.

7

I see that you have now merged a fix that will be in a future release of the agent.
Thanks.

1 Like