fix: set permissions of newly written loose objects to be similar to git.

Note that the current implementation lacks all of the sophistication that git
applies, and doing this properly definitely takes more work as we would need
to support `core.sharedRepository`.

Further, our tempfile implementation doesn't allow the setup of file modes
right when it matters, so that could mean quite some work to either workaround
or contribute.

Author: Byron

Diff for: gix-odb/src/store_impls/loose/write.rs

@@ -98,6 +98,16 @@ impl crate::traits::Write for Store {
 
 type CompressedTempfile = deflate::Write<NamedTempFile>;
 
+/// Access
+impl Store {
+    /// Return the path to the object with `id`.
+    ///
+    /// Note that is may not exist yet.
+    pub fn object_path(&self, id: &gix_hash::oid) -> PathBuf {
+        loose::hash_path(id, self.path.clone())
+    }
+}
+
 impl Store {
     fn dest(&self) -> Result<hash::Write<CompressedTempfile>, Error> {
         Ok(hash::Write::new(
@@ -137,6 +147,24 @@ impl Store {
                 return Ok(id);
             }
         }
+        #[cfg(unix)]
+        if let Ok(mut perm) = object_path.metadata().map(|m| m.permissions()) {
+            use std::os::unix::fs::PermissionsExt;
+            /// For now we assume the default with standard umask. This can be more sophisticated,
+            /// but we have the bare minimum.
+            fn comp_mode(_mode: u32) -> u32 {
+                0o444
+            }
+            let new_mode = comp_mode(perm.mode());
+            if (perm.mode() ^ new_mode) & !0o170000 != 0 {
+                perm.set_mode(new_mode);
+                std::fs::set_permissions(&object_path, perm).map_err(|err| Error::Io {
+                    source: err,
+                    message: "Failed to set permission bits",
+                    path: object_path.clone(),
+                })?;
+            }
+        }
         res.map_err(|err| Error::Persist {
             source: err,
             target: object_path,

Diff for: gix-odb/tests/fixtures/generated-archives/.gitignore

@@ -0,0 +1 @@
+repo_with_loose_objects.tar.xz

Diff for: gix-odb/tests/fixtures/repo_with_loose_objects.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -eu -o pipefail
+
+git init -q
+
+git checkout -b main
+touch this
+git add this
+git commit -q -m c1
+echo hello >> this
+git commit -q -am c2
+

Diff for: gix-odb/tests/odb/store/loose.rs

@@ -71,6 +71,33 @@ mod write {
         Ok(())
     }
 
+    #[test]
+    #[cfg(unix)]
+    fn it_writes_objects_with_similar_permissions() -> crate::Result {
+        let hk = gix_hash::Kind::Sha1;
+        let git_store = loose::Store::at(
+            gix_testtools::scripted_fixture_read_only("repo_with_loose_objects.sh")?.join(".git/objects"),
+            hk,
+        );
+        let expected_perm = git_store
+            .object_path(&gix_hash::ObjectId::empty_blob(hk))
+            .metadata()?
+            .permissions();
+
+        let tmp = tempfile::TempDir::new()?;
+        let store = loose::Store::at(tmp.path(), hk);
+        store.write_buf(gix_object::Kind::Blob, &[])?;
+        let actual_perm = store
+            .object_path(&gix_hash::ObjectId::empty_blob(hk))
+            .metadata()?
+            .permissions();
+        assert_eq!(
+            actual_perm, expected_perm,
+            "we explicitly equalize permissions to be similar to what `git` would do"
+        );
+        Ok(())
+    }
+
     #[test]
     fn collisions_do_not_cause_failure() -> crate::Result {
         let dir = tempfile::tempdir()?;