From 2525a9eb25cc331589328f73a0ac50eb6e576138 Mon Sep 17 00:00:00 2001
From: Zak Bearman <Zak@amslabs.net>
Date: Thu, 17 Sep 2026 22:34:17 +1200
Subject: [PATCH] fix: preserve readable deployment source modes

---
 Dockerfile                       | 2 +-
 scripts/deploy_ams_dev01.sh      | 4 ++--
 scripts/deploy_beta_ams_dev01.sh | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b48eabb..71f0f8d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -53,7 +53,7 @@ COPY --chown=magent:magent --from=frontend-builder /frontend/proxy.ts /app/front
 COPY --chown=magent:magent --from=frontend-builder /frontend/next-env.d.ts /app/frontend/next-env.d.ts
 COPY --chown=magent:magent --from=frontend-builder /frontend/tsconfig.json /app/frontend/tsconfig.json
 
-COPY docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
+COPY --chown=magent:magent docker/supervisord.conf /etc/supervisor/conf.d/magent.conf
 
 RUN chown -R magent:magent /app
 USER magent:magent
diff --git a/scripts/deploy_ams_dev01.sh b/scripts/deploy_ams_dev01.sh
index 33ff053..51933ca 100644
--- a/scripts/deploy_ams_dev01.sh
+++ b/scripts/deploy_ams_dev01.sh
@@ -28,7 +28,7 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
       cp -a \"\$path\" \"\${backup_root}/\"
     fi
   done
-  tar -xf - -C '${deploy_path}'
+  (umask 022; tar -xf - -C '${deploy_path}')
   if [ -f '${deploy_path}/.env' ]; then
     chmod 600 '${deploy_path}/.env'
   fi
@@ -41,7 +41,7 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
     chmod 600 .env
   fi
   docker compose run --rm --no-deps --entrypoint python magent -c \"from app.config import settings; from app.secret_storage import validate_secret_storage_configuration; assert len(str(settings.jwt_secret or '').strip()) >= 32, 'JWT_SECRET must contain at least 32 characters'; validate_secret_storage_configuration()\"
-  docker compose run --rm --user 0 magent chown -R 1000:1000 /app/data
+  docker compose run --rm --user 0 --cap-add CHOWN --cap-add DAC_OVERRIDE magent chown -R 1000:1000 /app/data
   docker compose up -d
 "
 
diff --git a/scripts/deploy_beta_ams_dev01.sh b/scripts/deploy_beta_ams_dev01.sh
index d1e7930..2cf29b4 100755
--- a/scripts/deploy_beta_ams_dev01.sh
+++ b/scripts/deploy_beta_ams_dev01.sh
@@ -29,7 +29,7 @@ git archive --format=tar HEAD | ssh ${ssh_opts} "${remote}" "
       cp -a \"\$path\" \"\${backup_root}/\"
     fi
   done
-  tar -xf - -C '${deploy_path}'
+  (umask 022; tar -xf - -C '${deploy_path}')
 
   if [ ! -f '${deploy_path}/.env' ]; then
     echo 'Beta .env is missing. Provision independent beta secrets before deploying.' >&2