Skip to content

jmcore.secure_files

jmcore.secure_files

Private directory and atomic secret-file utilities.

Functions:

atomic_write_private(path: Path, data: bytes) -> None

Atomically write bytes without exposing a permissively-mode temporary file.

Source code in jmcore/src/jmcore/secure_files.py 
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
def atomic_write_private(path: Path, data: bytes) -> None:
    """Atomically write bytes without exposing a permissively-mode temporary file."""
    _reject_parent_traversal(path)
    parent = path.parent
    if parent.is_symlink():
        raise OSError(f"refusing to use symlink as private directory: {parent}")
    if not parent.exists():
        ensure_private_directory(parent)

    fd, temp_name = tempfile.mkstemp(
        dir=parent,
        prefix=f".{path.name}.",
        suffix=".tmp",
    )
    temp_path = Path(temp_name)
    try:
        os.fchmod(fd, 0o600)
        with os.fdopen(fd, "wb") as temp_file:
            fd = -1
            temp_file.write(data)
            temp_file.flush()
            os.fsync(temp_file.fileno())
        os.replace(temp_path, path)
    finally:
        if fd >= 0:
            os.close(fd)
        with suppress(FileNotFoundError):
            temp_path.unlink()

ensure_private_directory(path: Path) -> None

Create or tighten a secret-bearing directory to owner-only access.

Source code in jmcore/src/jmcore/secure_files.py 
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
def ensure_private_directory(path: Path) -> None:
    """Create or tighten a secret-bearing directory to owner-only access."""
    _reject_parent_traversal(path)
    if path.is_symlink():
        raise OSError(f"refusing to use symlink as private directory: {path}")

    missing_parents: list[Path] = []
    parent = path.parent
    while not parent.exists():
        missing_parents.append(parent)
        if parent == parent.parent:
            break
        parent = parent.parent

    for parent in reversed(missing_parents):
        parent.mkdir(mode=0o700, exist_ok=True)
        _tighten_private_directory(parent)

    path.mkdir(mode=0o700, exist_ok=True)
    _tighten_private_directory(path)

ensure_private_file(path: Path) -> None

Tighten an existing regular secret file to owner-only access.

Source code in jmcore/src/jmcore/secure_files.py 
74
75
76
77
def ensure_private_file(path: Path) -> None:
    """Tighten an existing regular secret file to owner-only access."""
    fd = _open_private_regular_file(path)
    os.close(fd)

read_private_file(path: Path) -> bytes

Read and tighten a regular secret file through one no-follow descriptor.

Source code in jmcore/src/jmcore/secure_files.py 
80
81
82
83
84
def read_private_file(path: Path) -> bytes:
    """Read and tighten a regular secret file through one no-follow descriptor."""
    fd = _open_private_regular_file(path)
    with os.fdopen(fd, "rb") as private_file:
        return private_file.read()