From 7119dd6f1e7453bd7e971ad093c0be08c538fb7a Mon Sep 17 00:00:00 2001 From: Topher Hindman Date: Wed, 21 Oct 2026 20:36:08 -0700 Subject: [PATCH] fix(config): don't warn about config permissions on Windows Go reports mode 0666 for every writable file on Windows (0444 for a read-only one), so every lk command there warned that cli-config.yaml should be 0600, and chmod there can't change it. The check now runs only where file modes mean something; a script pins the warning off Windows and its absence on Windows. With the noise gone, TestScripts runs on Windows too: testscript sets the Windows home directory through USERPROFILE, so setupScript sets it as well as HOME, and the scripts are checked out with LF endings, as the TUI goldens are, since their expected output is compared byte for byte. --- .gitattributes | 4 ++++ cmd/lk/script_test.go | 10 +--------- .../script/config-permissions-warning.txtar | 14 ++++++++++++++ pkg/config/config.go | 7 +++++-- 4 files changed, 24 insertions(+), 11 deletions(-) create mode 100644 cmd/lk/testdata/script/config-permissions-warning.txtar diff --git a/.gitattributes b/.gitattributes index 923ad11da..77a870653 100644 --- a/.gitattributes +++ b/.gitattributes @@ -15,3 +15,7 @@ pkg/portaudio/pa_src/** linguist-vendored # core.autocrlf — the default on Windows, including the CI runners — rewrites # them to CRLF and every frame mismatches. cmd/lk/testdata/vrt/*.txt text eol=lf + +# The same holds for the testscript scripts: their expected stdout and stderr +# are compared byte for byte against lk's LF output. +cmd/lk/testdata/script/*.txtar text eol=lf diff --git a/cmd/lk/script_test.go b/cmd/lk/script_test.go index dc77cfca2..0eac672cc 100644 --- a/cmd/lk/script_test.go +++ b/cmd/lk/script_test.go @@ -62,7 +62,6 @@ import ( "os" "path/filepath" "regexp" - "runtime" "slices" "strconv" "strings" @@ -80,14 +79,6 @@ func TestMain(m *testing.M) { } func TestScripts(t *testing.T) { - if runtime.GOOS == "windows" { - // Three things stop the scripts on Windows: Go reports mode 0666 for - // every file there, so config.LoadOrCreate warns on each run that the - // config file should be 0600; testscript sets the home directory - // through USERPROFILE, which setupScript doesn't; and a Windows - // checkout writes the .txtar files with CRLF endings. - t.Skip("lk warns about the config file's permissions on every Windows run, and the scripts need USERPROFILE and LF checkouts") - } testscript.Run(t, testscript.Params{ Dir: filepath.Join("testdata", "script"), Setup: setupScript, @@ -107,6 +98,7 @@ type fakeCloudKey struct{} func setupScript(env *testscript.Env) error { home := filepath.Join(env.WorkDir, "home") env.Setenv("HOME", home) + env.Setenv("USERPROFILE", home) // the home directory on Windows // lk warns about a config file anyone else can read, and txtar files are // written 0644. err := os.Chmod(filepath.Join(home, ".livekit", "cli-config.yaml"), 0o600) diff --git a/cmd/lk/testdata/script/config-permissions-warning.txtar b/cmd/lk/testdata/script/config-permissions-warning.txtar new file mode 100644 index 000000000..32e1515ec --- /dev/null +++ b/cmd/lk/testdata/script/config-permissions-warning.txtar @@ -0,0 +1,14 @@ +# A config file others can read gets a warning, since it holds API secrets, +# except on Windows, where file modes don't say who can read it. +chmod 0644 home/.livekit/cli-config.yaml +exec lk project list +[!windows] stderr 'should have permissions 600' +[windows] ! stderr 'should have permissions' + +-- home/.livekit/cli-config.yaml -- +projects: + - name: one + project_id: p_1 + url: ws://one.test + api_key: APIone + api_secret: secretone diff --git a/pkg/config/config.go b/pkg/config/config.go index 8e54ceeac..2b3d89511 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -19,6 +19,7 @@ import ( "fmt" "os" "path" + "runtime" "strings" "time" @@ -332,9 +333,11 @@ func LoadOrCreate() (*CLIConfig, error) { return c, nil } else if err != nil { return nil, err - } else if s.Mode().Perm()&0077 != 0 { + } else if runtime.GOOS != "windows" && s.Mode().Perm()&0077 != 0 { // because this file contains private keys, warn that - // only the owner should have permission to access it + // only the owner should have permission to access it. Go reports + // 0666 for every writable file on Windows (0444 if read-only), so + // the mode says nothing there. util.Warnf("WARNING: config file %s should have permissions %o", configPath, 0600) }