cli: exported login should only be readable by owner
Metadata
Current evaluation
Merged a fix restricting CLI login file permissions to owner-only read access. Replaced click.File with click.Path to manually enforce secure file creation. Approved by two reviewers and passed CI checks.
Suggested action: —
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/snapcore/snapcraft/blob/master/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] If this is a bugfix. Have you checked that there is a bug report open for the issue you are trying to fix on [bug reports](https://bugs.launchpad.net/snapcraft)?
- [x] If this is a new feature. Have you discussed the design on the [forum](https://forum.snapcraft.io)?
- [x] Have you successfully run `./runtests.sh static`?
- [x] Have you successfully run `./runtests.sh unit`?
-----
When one uses click.File as an argument type, Click just saves it world-readable, and there doesn't seem to be a way to change it.
Use click.Path instead, and open the file ourselves. Then ensure that only the owner can read it once finished.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged a fix restricting CLI login file permissions to owner-only read access. Replaced click.File with click.Path to manually enforce secure file creation. Approved by two reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a fix restricting CLI login file permissions to owner-only. Replaced click.File with click.Path to manually open the file and enforce restrictive read permissions, resolving a world-readable security issue. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged a fix to restrict CLI login file permissions to owner-only. Replaced click.File with click.Path to manually open the file and enforce restrictive permissions, resolving a world-readable default. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2742 cli: use click utilities for login prompts | snapcraft | merged | Merged refactoring of CLI login prompts to use Click utilities. Approved by one reviewer, the change modified 20 files with a net reduction of 108 lines. Six unresolved review comments were present at merge. | |
| #2736 cli: prompt for login if required | snapcraft | merged | Merged CLI update that prompts for login when required instead of exiting with an error. Approved and passed CI checks. |