✅ Add regression test for default-off metadata on encrypted entries

Extracting a GCM-encrypted entry without --keep-permission must not
restore the archived mode, including the setuid bit.

Author: ChanTsune

cli/tests/cli/extract/option_keep_permission.rs

@@ -529,3 +529,106 @@ fn extract_preserves_directory_permission() {
     let meta = fs::symlink_metadata("extract_dir_perm/out/raw/images").unwrap();
     assert_eq!(meta.permissions().mode() & 0o777, 0o750,);
 }
+
+/// RAII guard for temporarily setting the process umask.
+/// Umask is process-global, so tests using this guard are protected by
+/// `#[serial(umask)]` to avoid racing with other tests that change it.
+#[cfg(unix)]
+struct UmaskGuard(libc::mode_t);
+
+#[cfg(unix)]
+impl UmaskGuard {
+    fn set(mask: u16) -> Self {
+        // SAFETY: libc::umask is always safe to call with any mode_t value.
+        // It atomically sets the new umask and returns the previous value.
+        unsafe { Self(libc::umask(mask as libc::mode_t)) }
+    }
+}
+
+#[cfg(unix)]
+impl Drop for UmaskGuard {
+    fn drop(&mut self) {
+        // SAFETY: Restoring the original umask value that was returned by
+        // the previous umask() call. This is always valid.
+        unsafe {
+            libc::umask(self.0);
+        }
+    }
+}
+
+/// Precondition: A GCM-encrypted archive contains a file with the setuid bit set (mode 0o4755),
+/// stored via `--keep-permission`.
+/// Action: Extract the archive without `--keep-permission`.
+/// Expectation: The extracted file has no special bits (setuid/setgid/sticky), and its
+/// permission bits are masked by the umask instead of the archived mode.
+#[test]
+#[cfg(unix)]
+#[serial_test::serial(umask)]
+fn extract_encrypted_gcm_without_keep_permission_drops_setuid() {
+    setup();
+    TestResources::extract_in("raw/", "extract_gcm_setuid/in/").unwrap();
+
+    set_permissions_or_skip!("extract_gcm_setuid/in/raw/text.txt", 0o4755);
+
+    cli::Cli::try_parse_from([
+        "pna",
+        "--quiet",
+        "c",
+        "-f",
+        "extract_gcm_setuid/archive.pna",
+        "--overwrite",
+        "extract_gcm_setuid/in/",
+        "--keep-permission",
+        "--aes",
+        "gcm",
+        "--password",
+        "password",
+    ])
+    .unwrap()
+    .execute()
+    .unwrap();
+
+    let mut found = false;
+    archive::for_each_entry_with_password(
+        "extract_gcm_setuid/archive.pna",
+        Some("password"),
+        |entry| {
+            if entry.header().path().as_str().ends_with("raw/text.txt") {
+                found = true;
+                let mode = entry.metadata().permission_mode().unwrap();
+                assert_eq!(mode.get() & 0o7777, 0o4755);
+            }
+        },
+    )
+    .unwrap();
+    assert!(found, "raw/text.txt entry not found in archive");
+
+    let _umask = UmaskGuard::set(0o022);
+    cli::Cli::try_parse_from([
+        "pna",
+        "--quiet",
+        "x",
+        "-f",
+        "extract_gcm_setuid/archive.pna",
+        "--overwrite",
+        "--out-dir",
+        "extract_gcm_setuid/out/",
+        "--password",
+        "password",
+        "--strip-components",
+        "2",
+    ])
+    .unwrap()
+    .execute()
+    .unwrap();
+
+    let extracted_mode = fs::symlink_metadata("extract_gcm_setuid/out/raw/text.txt")
+        .unwrap()
+        .permissions()
+        .mode();
+    assert_eq!(
+        extracted_mode & 0o7777,
+        0o666 & !0o022,
+        "without --keep-permission the archived mode (with setuid) must be replaced by the umask-masked default"
+    );
+}