3 files changed, 9 insertions(+), 6 deletions(-)

M guix/pki.scm
M guix/scripts/archive.scm
M guix/ssh.scm

@@ 1,5 1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2016, 2022 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013-2014, 2016, 2022, 2025 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;


@@ 87,7 87,8 @@ element in KEYS must be a canonical sexp with type 'public-key'."
         (with-atomic-file-output %acl-file
           (lambda (port)
             (write-acl (public-keys->acl (list public-key))
-                       port)))))))
+                       port)))
+        (chmod %acl-file #o644)))))
 
 (define (write-acl acl port)
   "Write ACL to PORT in canonical-sexp format."

@@ 1,5 1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2019, 2020, 2021 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013-2017, 2019-2021, 2025 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.


@@ 324,7 324,8 @@ the input port."
     (let ((acl (public-keys->acl (cons key (acl->public-keys acl)))))
       (mkdir-p (dirname %acl-file))
       (with-atomic-file-output %acl-file
-        (cut write-acl acl <>)))))
+        (cut write-acl acl <>))
+      (chmod %acl-file #o644))))
 
 (define (list-contents port)
   "Read a nar from PORT and print the list of files it contains to the current

@@ 1,5 1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2016-2021, 2023-2024 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2016-2021, 2023-2025 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;


@@ 458,7 458,8 @@ to the system ACL file if it has not yet been authorized."
         (let ((acl (public-keys->acl (cons key (acl->public-keys acl)))))
           (mkdir-p (dirname %acl-file))
           (with-atomic-file-output %acl-file
-            (cut write-acl acl <>)))))
+            (cut write-acl acl <>))
+          (chmod %acl-file #o644))))
    session
    become-command))