File permissions issue when upgrading from 1.5.4 to 1.6.4

After upgrading to 1.6.4 and following the upgrade changes listed here, I see that files that are compiled, such as less files, don’t take on permissions like they once did.

I’m serving statics from a separate user (ubuntu user in the ubuntu group) and the lastest django-pipeline changes causes the front end to throw a 403 since the static’s user can no longer see the files that have been complied (lacking correct group permissions).

Look at the file permissions for the compiled file before and after the upgrade:

django-pipeline 1.5.4

Everything works as expected.

-rw-r--r--  1 troy    ubuntu  2658 Jan  5 10:48 activities.css
-rw-rw-r--  1 ubuntu  ubuntu  3234 Jan  5 10:16 activities.less

django-pipeline 1.6.4

Get 403’s on the front end because the group no longer has read permissions to activities.css.

-rw-------  1 troy    ubuntu  2658 Jan  5 10:31 activities.css
-rw-rw-r--  1 ubuntu  ubuntu  3234 Jan  5 10:16 activities.less

This is using python 3.4.3, django 1.8.7.

[StoicLoofah]

I did some poking around, and I believe the problem was introduced in 1.6.1 in this block https://github.com/jazzband/django-pipeline/blob/1.6.1/pipeline/compilers/__init__.py#L122-L145 in commit 1f6b48ae74026a12f955f2f15f9f08823d744515

For me, the collectstatic call appears to work correctly: this comes up when {% stylesheet MYFILE %} is actually invoked as a templatetag: the stylesheet is recompiled.

The issue appears to be that the temporary file is assigned the mask 600, and when it is renamed, it doesn’t update it to the same permission as before. In my situation, this is problematic because my static files are being served over apache.

I don’t really understand the mechanics of why the process is designed the way that it is, but perhaps someone else who does understand can chime in?

[siovene]

Please note, this only happens with the Less compiler. Converted my files to sass and the issue is not reproduced.