From 9404c09caee24ad303c6aae1fe856cf0c51a0b20 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Fri, 4 Sep 2026 06:27:42 +0000
Subject: [PATCH 1/3] test: expose umask-dependent Debian modes

---
 test/build-deb.test.js | 65 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 test/build-deb.test.js

diff --git a/test/build-deb.test.js b/test/build-deb.test.js
new file mode 100644
index 0000000..b6db0d5
--- /dev/null
+++ b/test/build-deb.test.js
@@ -0,0 +1,65 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const ROOT = path.join(__dirname, '..');
+
+function copyTree(source, destination) {
+  fs.cpSync(source, destination, { recursive: true });
+}
+
+function buildPackage(umask) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-build-deb-test-'));
+  const bin = path.join(root, 'bin');
+  fs.mkdirSync(path.join(root, 'scripts'));
+  fs.mkdirSync(bin);
+  fs.copyFileSync(path.join(ROOT, 'scripts', 'build-deb.sh'), path.join(root, 'scripts', 'build-deb.sh'));
+  copyTree(path.join(ROOT, 'src'), path.join(root, 'src'));
+  fs.copyFileSync(path.join(ROOT, 'package.json'), path.join(root, 'package.json'));
+  fs.copyFileSync(path.join(ROOT, 'package-lock.json'), path.join(root, 'package-lock.json'));
+
+  const npm = path.join(bin, 'npm');
+  fs.writeFileSync(npm, '#!/usr/bin/env bash\nexit 0\n');
+  fs.chmodSync(npm, 0o755);
+
+  const result = spawnSync(
+    'bash',
+    ['-c', 'umask "$1"; exec bash "$2"', 'build-deb-test', umask, path.join(root, 'scripts', 'build-deb.sh')],
+    {
+      encoding: 'utf8',
+      env: { ...process.env, PATH: `${bin}:${process.env.PATH}` },
+    },
+  );
+  assert.equal(result.status, 0, result.stderr);
+
+  const deb = path.join(root, 'dist', 'stoke_1.5.0_all.deb');
+  const listing = spawnSync('dpkg-deb', ['-c', deb], { encoding: 'utf8' });
+  assert.equal(listing.status, 0, listing.stderr);
+
+  const modes = new Map();
+  for (const line of listing.stdout.trim().split('\n')) {
+    const fields = line.trim().split(/\s+/);
+    const archivePath = fields.find((field) => field.startsWith('./usr/'));
+    if (archivePath && (fields[0].startsWith('d') || fields[0].startsWith('-'))) {
+      modes.set(archivePath, fields[0]);
+    }
+  }
+  return { root, modes };
+}
+
+test('Debian payload modes are identical under umask 077 and 022', (t) => {
+  const restrictive = buildPackage('077');
+  const standard = buildPackage('022');
+  t.after(() => {
+    fs.rmSync(restrictive.root, { recursive: true, force: true });
+    fs.rmSync(standard.root, { recursive: true, force: true });
+  });
+
+  assert.deepEqual(restrictive.modes, standard.modes);
+  for (const [archivePath, mode] of restrictive.modes) {
+    assert.equal(mode, archivePath.endsWith('/') ? 'drwxr-xr-x' : archivePath === './usr/lib/stoke/src/cli.js' ? '-rwxr-xr-x' : '-rw-r--r--', archivePath);
+  }
+});

From cef903b77e1bfdcfc6222cf91b14443813604cfc Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Fri, 4 Sep 2026 06:28:29 +0000
Subject: [PATCH 2/3] fix: normalize Debian payload modes

---
 scripts/build-deb.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/build-deb.sh b/scripts/build-deb.sh
index 9d60d6f..9af165b 100755
--- a/scripts/build-deb.sh
+++ b/scripts/build-deb.sh
@@ -67,9 +67,9 @@ EOF
 # Native package (no Debian revision in the version), so plain changelog.gz.
 gzip -9n -c "$STAGE/changelog" > "$DOC/changelog.gz"
 
-# Normalize permissions regardless of the builder's umask: no group/other
-# write anywhere, executable entry point.
-chmod -R go-w "$PKG/usr"
+# Normalize permissions regardless of the builder's umask: traversable
+# directories, readable files, and execute bits retained only where intended.
+chmod -R u+rwX,go=rX "$PKG/usr"
 chmod 0755 "$LIB/src/cli.js"
 
 # --- control -----------------------------------------------------------------

From 44bbeadff6c882d383b0afa440f2e1d1ffda14b4 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Fri, 4 Sep 2026 06:28:51 +0000
Subject: [PATCH 3/3] docs: record deterministic Debian modes

---
 changelog.d/63.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/63.md

diff --git a/changelog.d/63.md b/changelog.d/63.md
new file mode 100644
index 0000000..63af7f4
--- /dev/null
+++ b/changelog.d/63.md
@@ -0,0 +1 @@
+- Normalize Debian package payload modes independently of the builder's umask. (#63).