impr: engine - copy files with 444 permissions

internal/engine/docker.go

@@ -156,7 +156,7 @@ func (e *Docker) copyFiles(box *config.Box, dir string) error {
 		return nil
 	}
 	for _, pattern := range box.Files {
-		err := fileio.CopyFiles(pattern, dir)
+		err := fileio.CopyFiles(pattern, dir, 0444)
 		if err != nil {
 			return err
 		}

internal/fileio/fileio.go

@@ -14,7 +14,7 @@ import (
 
 // CopyFile copies all files matching the pattern
 // to the destination directory.
-func CopyFiles(pattern string, dstDir string) error {
+func CopyFiles(pattern string, dstDir string, perm fs.FileMode) error {
 	matches, err := filepath.Glob(pattern)
 	if err != nil {
 		return err
@@ -28,7 +28,7 @@ func CopyFiles(pattern string, dstDir string) error {
 		defer src.Close()
 
 		dstFile := filepath.Join(dstDir, filepath.Base(match))
-		dst, err := os.Create(dstFile)
+		dst, err := os.OpenFile(dstFile, os.O_RDWR|os.O_CREATE|os.O_TRUNC, perm)
 		if err != nil {
 			return err
 		}

internal/fileio/fileio_test.go

@@ -1,6 +1,7 @@
 package fileio
 
 import (
+	"io/fs"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -30,18 +31,22 @@ func TestCopyFiles(t *testing.T) {
 	defer os.RemoveAll(dstDir)
 
 	// Call the CopyFiles function
+	const perm = fs.FileMode(0444)
 	pattern := filepath.Join(srcDir, "*.txt")
-	err = CopyFiles(pattern, dstDir)
+	err = CopyFiles(pattern, dstDir, perm)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	// Verify that the file was copied correctly
 	dstFile := filepath.Join(dstDir, "source.txt")
-	_, err = os.Stat(dstFile)
+	fileInfo, err := os.Stat(dstFile)
 	if err != nil {
 		t.Fatalf("file not copied: %s", err)
 	}
+	if fileInfo.Mode() != perm {
+		t.Errorf("unexpected file permissions: got %v, want %v", fileInfo.Mode(), perm)
+	}
 
 	// Read the contents of the copied file
 	data, err := os.ReadFile(dstFile)
@@ -122,6 +127,22 @@ func TestWriteFile(t *testing.T) {
 		}
 	})
 
+	t.Run("perm", func(t *testing.T) {
+		const perm = fs.FileMode(0444)
+		path := filepath.Join(dir, "perm.txt")
+		err = WriteFile(path, "hello", perm)
+		if err != nil {
+			t.Fatalf("expected nil err, got %v", err)
+		}
+		fileInfo, err := os.Stat(path)
+		if err != nil {
+			t.Fatalf("file not created: %s", err)
+		}
+		if fileInfo.Mode() != perm {
+			t.Errorf("unexpected file permissions: got %v, want %v", fileInfo.Mode(), perm)
+		}
+	})
+
 	t.Run("missing data-url separator", func(t *testing.T) {
 		path := filepath.Join(dir, "data.bin")
 		err = WriteFile(path, "data:application/octet-stream:MTIz", 0444)