Merge pull request #51 from ppandit-sfdc/fix/copyfile-preserve-permissions

Fix permission-dropped executable bit in zip dependency staging

Author: jcatt-sf

src/utils/zipBuilder.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 import { existsSync, mkdtempSync, rmSync, statSync, readFileSync } from 'node:fs';
-import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { copyFile, mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import * as path from 'node:path';
 import { debuglog } from 'node:util';
@@ -146,11 +146,6 @@ function assertBuildFileExists(label: string, filePath: string): void {
   }
 }
 
-async function copyFile(src: string, dest: string): Promise<void> {
-  const data = new Uint8Array(await readFile(src));
-  await writeFile(dest, data);
-}
-
 async function copyTree(src: string, dest: string): Promise<void> {
   const entries = await readdir(src, { withFileTypes: true });
   await mkdir(dest, { recursive: true });

test/utils/zipBuilder.test.ts

@@ -22,6 +22,7 @@ import {
   readFileSync,
   symlinkSync,
   chmodSync,
+  statSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import * as path from 'node:path';
@@ -464,4 +465,51 @@ describe('zipBuilder.prepareDependencyArchive', () => {
     expect(caught!.message).to.match(/Dockerfile\.dependencies/);
     expect(missing.calls.build).to.have.length(0);
   });
+
+  it('stages build_native_dependencies.sh with executable permission preserved', async function () {
+    if (process.platform === 'win32') {
+      this.skip();
+      return;
+    }
+    chmodSync(path.join(baseDir, 'build_native_dependencies.sh'), 0o755);
+
+    const { runner } = makeRunner({
+      imageExists: true,
+      onRun: (mountPath) => {
+        const stagedScript = path.join(mountPath, 'build_native_dependencies.sh');
+        const mode = statSync(stagedScript).mode & 0o777;
+        expect(mode & 0o111, 'staged build script must have executable bits').to.not.equal(0);
+        writeFileSync(path.join(mountPath, 'native_dependencies.tar.gz'), 'data');
+      },
+    });
+
+    await prepareDependencyArchive(baseDir, 'default', 'script', () => {}, runner);
+  });
+
+  it('preserves executable permissions on py-files copied via copyTree (function packages)', async function () {
+    if (process.platform === 'win32') {
+      this.skip();
+      return;
+    }
+
+    const { runner } = makeRunner({
+      imageExists: true,
+      onRun: (mountPath) => {
+        const pyFilesSrc = path.join(mountPath, 'py-files');
+        mkdirSync(pyFilesSrc);
+        const execScript = path.join(pyFilesSrc, 'run_me.sh');
+        writeFileSync(execScript, '#!/bin/bash\necho hello\n');
+        chmodSync(execScript, 0o755);
+        writeFileSync(path.join(pyFilesSrc, 'lib.py'), 'pass');
+      },
+    });
+
+    await prepareDependencyArchive(baseDir, 'default', 'function', () => {}, runner);
+
+    const dest = path.join(baseDir, 'payload', 'py-files');
+    const scriptMode = statSync(path.join(dest, 'run_me.sh')).mode & 0o777;
+    const libMode = statSync(path.join(dest, 'lib.py')).mode & 0o777;
+    expect(scriptMode & 0o111, 'executable script in py-files must retain execute bits').to.not.equal(0);
+    expect(libMode & 0o111, 'non-executable file should not gain execute bits').to.equal(0);
+  });
 });