Incorrect permissions on *.egg-info directory

It seems that the setup.py install command doesn’t set the permissions of the <package>.egg-info/* files when they already exist, relying on what is already set. As noted in https://github.com/sshuttle/sshuttle/issues/217#issuecomment-381378684, it seems many other projects suffered from the same “bug” in the last years, relying on the packager to set the permissions manually to 644 before uploading to PyPI.

Relying on the umask of the user during the package tarball creation is too error-prone, so maybe permissions should always be set automatically by setuptools.

Maybe this issue is a duplicate of https://github.com/pypa/setuptools/issues/1283, I’m not sure.

[cpixl]

Yes, using pip install . still gives me the wrong permissions for the <package>.egg-info/* files.

ls -lh /usr/lib/python3.6/site-packages/sshuttle-0.78.4-py3.6.egg-info/ :

total 24K
-rw------- 1 root root    1 Apr 19 01:20 dependency_links.txt
-rw------- 1 root root   52 Apr 19 01:20 entry_points.txt
-rw-r--r-- 1 root root 1.8K Apr 19 01:20 installed-files.txt
-rw------- 1 root root 3.1K Apr 19 01:20 PKG-INFO
-rw------- 1 root root 1.5K Apr 19 01:20 SOURCES.txt
-rw------- 1 root root    9 Apr 19 01:20 top_level.txt

[lilydjwg]

Telethon had similar issues too. It made many (if not all) Python programs fail due to unreadable files when installed by root (e.g. system package managers). It also has several generated world-writable files.

What’s more, when one extracts the sdist tarball as root, the files are owned by whatever uid and gid the tarball has recorded.

Is it possible to give all files in the created tarballs 755 / 644 permissions and owned by root:root?