Minor.

Author: pavel-raykov

keystore/atomicfile/write.go

@@ -0,0 +1,70 @@
+package atomicfile
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// WriteFile atomically writes the contents of r to the specified filepath with the default permission 0600.
+// This is a copy of https://github.com/natefinch/atomic/blob/master/atomic.go with minor modifications allowing
+// to set mode of the written file. If the file already exists, its mode is preserved.
+func WriteFile(filename string, r io.Reader, mode os.FileMode) (err error) {
+	// write to a temp file first, then we'll atomically replace the target file
+	// with the temp file.
+	dir, file := filepath.Split(filename)
+	if dir == "" {
+		dir = "."
+	}
+
+	f, err := os.CreateTemp(dir, file)
+	if err != nil {
+		return fmt.Errorf("cannot create temp file: %v", err)
+	}
+	defer func() {
+		if err != nil {
+			// Don't leave the temp file lying around on error.
+			_ = os.Remove(f.Name()) // yes, ignore the error, not much we can do about it.
+		}
+	}()
+	// ensure we always close f. Note that this does not conflict with the close below, as close is idempotent.
+	defer f.Close()
+	name := f.Name()
+	if _, err := io.Copy(f, r); err != nil {
+		return fmt.Errorf("cannot write data to tempfile %q: %v", name, err)
+	}
+	// fsync is important, otherwise os.Rename could rename a zero-length file
+	if err := f.Sync(); err != nil {
+		return fmt.Errorf("can't flush tempfile %q: %v", name, err)
+	}
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("can't close tempfile %q: %v", name, err)
+	}
+
+	// get the file mode from the original file and use that for the replacement file, too.
+	destInfo, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		// no original file
+		if err := os.Chmod(name, mode); err != nil {
+			return fmt.Errorf("can't set filemode on tempfile %q: %v", name, err)
+		}
+	} else if err != nil {
+		return err
+	} else {
+		sourceInfo, err := os.Stat(name)
+		if err != nil {
+			return err
+		}
+
+		if sourceInfo.Mode() != destInfo.Mode() {
+			if err := os.Chmod(name, destInfo.Mode()); err != nil {
+				return fmt.Errorf("can't set filemode on tempfile %q: %v", name, err)
+			}
+		}
+	}
+	if err := os.Rename(name, filename); err != nil {
+		return fmt.Errorf("cannot replace %q with tempfile %q: %v", filename, name, err)
+	}
+	return nil
+}

keystore/atomicfile/write_test.go

@@ -0,0 +1,20 @@
+package atomicfile
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteFile_WriteAndRead(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "out.txt")
+	data := []byte("test")
+	err := WriteFile(path, bytes.NewReader(data), 0600)
+	require.NoError(t, err)
+	readData, err := os.ReadFile(path)
+	require.NoError(t, err)
+	require.Equal(t, readData, data)
+}

keystore/file.go

@@ -5,7 +5,7 @@ import (
 	"context"
 	"os"
 
-	"github.com/natefinch/atomic"
+	"github.com/smartcontractkit/chainlink-common/keystore/atomicfile"
 )
 
 var _ Storage = &FileStorage{}
@@ -26,5 +26,5 @@ func (f *FileStorage) GetEncryptedKeystore(ctx context.Context) ([]byte, error)
 }
 
 func (f *FileStorage) PutEncryptedKeystore(ctx context.Context, encryptedKeystore []byte) error {
-	return atomic.WriteFile(f.name, bytes.NewReader(encryptedKeystore))
+	return atomicfile.WriteFile(f.name, bytes.NewReader(encryptedKeystore), 0600)
 }

keystore/internal/raw_test.go

@@ -23,6 +23,8 @@ func TestRaw_nonprintable(t *testing.T) {
 
 	assert.Equal(t, exp, fmt.Sprintf("%#v", r))
 
+	assert.Equal(t, exp, fmt.Sprintf("%x", r))
+
 	assert.Equal(t, exp, fmt.Sprintf("%s", r)) //nolint:gosimple // S1025 deliberately testing formatting verbs
 
 	got, err := json.Marshal(r) //nolint:staticcheck // SA9005 deliberately testing marshalling