Use deterministic umask when staging sources.

This fix is applied to plugins bzr, git, patch.

Fixes #543 #544 #555.

buildstream/plugins/sources/bzr.py

@@ -123,7 +123,8 @@ class BzrSource(Source):
                    "--revision=revno:{}".format(self.ref),
                    self._get_branch_dir(), directory],
                   fail="Failed to checkout revision {} from branch {} to {}"
-                  .format(self.ref, self._get_branch_dir(), directory))
+                  .format(self.ref, self._get_branch_dir(), directory),
+                  deterministic_umask=True)
         # Remove .bzr dir
         shutil.rmtree(os.path.join(directory, ".bzr"))
 

buildstream/plugins/sources/git.py

@@ -198,11 +198,13 @@ class GitMirror(SourceFetcher):
         # directory.
         self.source.call([self.source.host_git, 'clone', '--no-checkout', '--shared', self.mirror, fullpath],
                          fail="Failed to create git mirror {} in directory: {}".format(self.mirror, fullpath),
-                         fail_temporarily=True)
+                         fail_temporarily=True,
+                         deterministic_umask=True)
 
         self.source.call([self.source.host_git, 'checkout', '--force', self.ref],
                          fail="Failed to checkout git ref {}".format(self.ref),
-                         cwd=fullpath)
+                         cwd=fullpath,
+                         deterministic_umask=True)
 
         # Remove .git dir
         shutil.rmtree(os.path.join(fullpath, ".git"))

buildstream/plugins/sources/patch.py

@@ -90,9 +90,10 @@ class PatchSource(Source):
                 raise SourceError("Nothing to patch in directory '{}'".format(directory),
                                   reason="patch-no-files")
 
-            strip_level_option = "-p{}".format(self.strip_level)
-            self.call([self.host_patch, strip_level_option, "-i", self.fullpath, "-d", directory],
-                      fail="Failed to apply patch {}".format(self.path))
+        strip_level_option = "-p{}".format(self.strip_level)
+        self.call([self.host_patch, strip_level_option, "-i", self.fullpath, "-d", directory],
+                  fail="Failed to apply patch {}".format(self.path),
+                  deterministic_umask=True)
 
 
 # Plugin entry point

buildstream/utils.py

@@ -998,18 +998,29 @@ def _kill_process_tree(pid):
 # Args:
 #    popenargs (list): Popen() arguments
 #    terminate (bool): Whether to attempt graceful termination before killing
+#    deterministic_umask (bool): Whether to set umask to 0o022
 #    rest_of_args (kwargs): Remaining arguments to subprocess.call()
 #
 # Returns:
 #    (int): The process exit code.
 #    (str): The program output.
 #
-def _call(*popenargs, terminate=False, **kwargs):
+def _call(*popenargs, terminate=False, deterministic_umask=False, **kwargs):
 
     kwargs['start_new_session'] = True
 
     process = None
 
+    if deterministic_umask:
+        old_preexec_fn = kwargs.get('preexec_fn')
+
+        def preexec_fn():
+            os.umask(stat.S_IWGRP | stat.S_IWOTH)
+            if old_preexec_fn is not None:
+                old_preexec_fn()
+
+        kwargs['preexec_fn'] = preexec_fn
+
     # Handle termination, suspend and resume
     def kill_proc():
         if process: