Static release carry: explicit 0444 under UMask 0027 #9
2026-11-14
Carry comment: the web server reads the file, no verifier enforces it
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Static release carry: explicit 0444 under UMask 0027
The carry file was created with .mode(0o444), which the service's UMask=0027 masks to 0440; www-data could not read it and the sealed-tree verifier rejected it. Set the permissions on the open handle before the rename, and prove it in a child process under umask 0027. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>