Gem installs many of its files as world writable

[eoinkelly]

First, thank you for your work on this gem!

It seems version 0.2.6 installs a number of files as world writable. This is is bad security practice and is causing one of our server hardening checks which searches for world writable files to fail.

These permissions are not part of the git repo so I'm guessing this is happening during gem packaging somehow.

Steps to reproduce

$ wget https://rubygems.org/downloads/capistrano-locally-0.2.0.gem

$ gem unpack ./capistrano-locally-0.2.6.gem
Unpacked gem: '/Users/eoinkelly/Downloads/capistrano-locally-0.2.6'

$ tree -p ./capistrano-locally-0.2.6
./capistrano-locally-0.2.6
├── [-rw-rw-rw-]  Gemfile
├── [-rw-rw-rw-]  LICENSE.txt
├── [-rw-r--r--]  README.md
├── [-rw-rw-rw-]  Rakefile
├── [drwxr-xr-x]  bin
│   ├── [-rwxrwxrwx]  console
│   └── [-rwxrwxrwx]  setup
├── [-rw-r--r--]  capistrano-locally.gemspec
└── [drwxr-xr-x]  lib
    └── [drwxr-xr-x]  capistrano
        ├── [drwxr-xr-x]  locally
        │   └── [-rw-rw-rw-]  version.rb
        └── [-rw-r--r--]  locally.rb

4 directories, 9 files

Notice that the following files are world writable:

capistrano-locally-0.2.6/.rspec
capistrano-locally-0.2.6/Gemfile
capistrano-locally-0.2.6/bin/console
capistrano-locally-0.2.6/bin/setup
capistrano-locally-0.2.6/LICENSE.txt
capistrano-locally-0.2.6/lib/capistrano/locally/version.rb
capistrano-locally-0.2.6/Rakefile

[komazarari]

oh, thank you for pointing it out! I'll deal with it soon.

[komazarari]

❯ gem unpack ./capistrano-locally-0.2.7.gem
Unpacked gem: '/tmp/capistrano-locally-0.2.7'

❯ tree -ap capistrano-locally-0.2.7/
capistrano-locally-0.2.7/
├── [drwxr-xr-x]  .circleci
│   └── [-rw-r--r--]  config.yml
├── [-rw-r--r--]  .gitignore
├── [-rw-r--r--]  .rspec
├── [-rw-r--r--]  Gemfile
├── [-rw-r--r--]  LICENSE.txt
├── [-rw-r--r--]  README.md
├── [-rw-r--r--]  Rakefile
├── [drwxr-xr-x]  bin
│   ├── [-rwxr-xr-x]  console
│   └── [-rwxr-xr-x]  setup
├── [-rw-r--r--]  capistrano-locally.gemspec
└── [drwxr-xr-x]  lib
    └── [drwxr-xr-x]  capistrano
        ├── [drwxr-xr-x]  locally
        │   └── [-rw-r--r--]  version.rb
        └── [-rw-r--r--]  locally.rb

5 directories, 12 files

Fixed by re-packing as 0.2.7.
I'm closing this issue but please let me know if you have any concerns about it.

Thank you.