zipapp creates executable files with wrong permissions bits #96867

Owing to the fact that open() has no flags field for marking a file as executable, and doing that after the fact is difficult (since it involves playing around with umask), the current implementation of zipapp uses the following code to attempt to set the file executable:

os.chmod(new_archive, os.stat(new_archive).st_mode | stat.S_IEXEC)

Which is incorrect: this sets only the execute bit for the user, and will never set it for the group or "other" categories, regardless of the umask.

This was discussed in a series of comments in #96772, starting around

#67679 (comment)

Create and open executable file respecting the Unix user's umask:

os.fdopen(os.open(filename, os.O_CREAT|os.O_RDWR), "rw")

and ending with

#67679 (comment)

OK, thanks. I don't propose to go there with the initial implementation. If it's a problem in practice, someone can raise a bug and we'll fix it then. (I've never seen actual Python code in the wild that does all of that...)

This is a problem in practice for us.

We're trying to replace the C version of Cockpit with a Python zipapp, and the file gets created with permissions that allow the current user to run it, but won't allow the file to be installed in /usr/bin so everyone can run it.

We can work around it easy enough — chmod +x in the Makefile after we call zipapp, but this is a bug in zipapp that really ought to be fixed.

For what it's worth, I think the os.fdopen() approach originally proposed by "dholth" is the best one.

Linked PRs

• gh-96867: Set zipapp execute bits from readable bits #151970