Chalk creates a chalk-reports.jsonl file with no perms

[psiinon]

Description

When chalking a docker image on my MacBook chalk creates a chalk-reports.jsonl file with no perms.
The next time I run the same command it fails with ERROR: failed to solve: error from sender: failed to xattr chalk-reports.jsonl: permission denied

Impact

The command fails.
Theres a simple work around though - just delete the chalk-reports.jsonl file.

Steps to Reproduce

I dont know if it fails in the same way with other docker images - I tried creating a v simple one but that didnt do the same thing.

git clone https://github.com/juice-shop/juice-shop.git
cd juice-shop
chalk docker buildx build  -t chalk-test -f Dockerfile .
ls -l chalk-reports.jsonl
chalk docker buildx build  -t chalk-test -f Dockerfile .

Other Information

ls -l chalk-reports.jsonl
----------  1 simon  staff  0 16 Feb 16:44 chalk-reports.jsonl

uname -mo
Darwin arm64

docker -v
Docker version 20.10.21, build baeda1f

[miki725]

@psiinon did you had any custom chalk config loaded? I cant reproduce it with vanilla chalk config although with vanilla config there are no failing reports hence no chalk-reports.jsonl file at all for me. I tried configuring chalk with a bad post report URL sink config and that wrote the jsonl file with appropriate permissions in my case:

➜ ls -l chalk*
.rw------- root root 9.8 KB Mon Mar 18 23:30:26 2024  chalk-reports.jsonl

not sure why would a file be created without any permissions though

chalk/src/reportcache.nim

Lines 384 to 399 in 7209e15

	try:
	(tmpfile, tmpname) = createTempFile("chalk-report-cache", ".jsonl")
	tmpfile.write(newCacheContents)
	except:
	panicPublish(newCacheContents, "", fname, getCurrentExceptionMsg())
	dumpExOnDebug()
	return
	finally:
	try:
	tmpfile.close()
	except:
	discard
	try:
	removeFile(fname)
	moveFile(tmpname, fname)

that creates a temp file, then removes any existing chalk-reports.jsonl file and moves the temp file to chalk-reports.jsonl location. createTempFile is part of nim stdlib so dont think that would do anything strange with permissions

cc @ee7 any ideas?

[ee7]

Well, I believe the relevant code is here. From the quickest glance: it looks like this should only happen if S_IRUSR and S_IWUSR are 0. I'm not a macOS user, but on Linux amd64 they're defined here and here to have the expected values. On macOS I think they get defined through this, so that'd be my first guess at where the problem is.

It's certainly possible that std/tempfiles exhibits buggy behavior on some platforms, though. It's not the most mature stdlib module. And this issue brings to mind some old problems in std/tempfiles: nim-lang/Nim#17888.