From 0aa98aa09b4585f2f32004b7aebe27682ece9192 Mon Sep 17 00:00:00 2001
From: Joey Hess <joeyh@joeyh.name>
Date: Wed, 26 Apr 2023 16:22:15 -0400
Subject: [PATCH] fix perms for core.sharedRepository

These two missed setting it.

It rarely matters that the journal gets the right perm. But, when using
annex.alwayscommit=false, someone else may come along later and want
to append to the journal file.

It probably never matters what the sentinal perms are, but for
completeness..

Sponsored-by: Luke Shumaker on Patreon
---
 Annex/InodeSentinal.hs | 2 ++
 Annex/Journal.hs       | 5 ++++-
 CHANGELOG              | 5 +++--
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Annex/InodeSentinal.hs b/Annex/InodeSentinal.hs
index f5483f688a..129dd08b71 100644
--- a/Annex/InodeSentinal.hs
+++ b/Annex/InodeSentinal.hs
@@ -93,6 +93,8 @@ createInodeSentinalFile evenwithobjects =
 		s <- annexSentinalFile
 		createAnnexDirectory (parentDir (sentinalFile s))
 		liftIO $ writeSentinalFile s
+		setAnnexFilePerm (sentinalFile s)
+		setAnnexFilePerm (sentinalCacheFile s)
   where
 	alreadyexists = liftIO. sentinalFileExists =<< annexSentinalFile
 	hasobjects
diff --git a/Annex/Journal.hs b/Annex/Journal.hs
index ce0f26e63e..48b12c0450 100644
--- a/Annex/Journal.hs
+++ b/Annex/Journal.hs
@@ -91,7 +91,10 @@ setJournalFile _jl ru file content = withOtherTmp $ \tmp -> do
 	let tmpfile = tmp P.</> jfile
 	liftIO $ withFile (fromRawFilePath tmpfile) WriteMode $ \h ->
 		writeJournalHandle h content
-	let mv = liftIO $ moveFile tmpfile (jd P.</> jfile)
+	let dest = jd P.</> jfile
+	let mv = do
+		liftIO $ moveFile tmpfile dest
+		setAnnexFilePerm dest
 	-- avoid overhead of creating the journal directory when it already
 	-- exists
 	mv `catchIO` (const (createAnnexDirectory jd >> mv))
diff --git a/CHANGELOG b/CHANGELOG
index 4e7384b6e8..d11c36bb40 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -29,9 +29,10 @@ git-annex (10.20230408) UNRELEASED; urgency=medium
     --json-error-messages is enabled, output a JSON object indicating the
     problem. (But git ls-files --error-unmatch still displays errors about
     such files in some situations.)
-  * init: Bug fix: Create .git/annex/ and .git/annex/fsckdb/ directories with
-    permissions configured by core.sharedRepository.
   * Warn about unsupported core.sharedRepository=0xxx when set.
+  * Bug fix: Create .git/annex/, .git/annex/fsckdb,
+    .git/annex/sentinal, .git/annex/sentinal.cache, and
+    .git/annex/journal/* with permissions configured by core.sharedRepository.
 
  -- Joey Hess <id@joeyh.name>  Sat, 08 Apr 2023 13:57:18 -0400