download, downloadunpacked: Each shared part should be read-only.

slapos/recipe/download.py

@@ -30,6 +30,7 @@ import shutil
 import zc.buildout
 import logging
 from hashlib import md5
+from downloadunpacked import make_read_only_recursively
 
 class Recipe(object):
   _parts = None
@@ -110,6 +111,7 @@ class Recipe(object):
     if self._shared:
       with open(os.path.join(parts, ".slapos.recipe.build.signature"), 'w') as f:
         f.write('\n'.join(self._debug_signature_text))
+      make_read_only_recursively(self._parts)
     return result
 
   def update(self):

slapos/recipe/downloadunpacked.py

@@ -32,6 +32,7 @@ import tarfile
 import zc.buildout
 import tempfile
 import setuptools.archive_util
+import stat
 from hashlib import md5
 
 is_true = ('false', 'true').index
@@ -161,6 +162,7 @@ class Recipe:
     if self.shared:
       with open(os.path.join(self.parts, ".slapos.recipe.build.signature"), 'w') as f:
         f.write('\n'.join(self._debug_signature_text))
+      make_read_only_recursively(self.parts)
       return []
     if self.parts is not None:
       return [self.parts]
@@ -222,3 +224,15 @@ def unpatch_archive_util():
     setuptools.archive_util.unpack_zipfile,
     setuptools.archive_util.unpack_tarfile,
   )
+
+_read_only_mask = 0o777 ^ (stat.S_IWRITE | stat.S_IWGRP | stat.S_IWOTH)
+def make_read_only(path):
+  os.chmod(path, os.stat(path).st_mode & _read_only_mask)
+
+def make_read_only_recursively(path):
+  make_read_only(path)
+  for root, dir_list, file_list in os.walk(path):
+    for dir in dir_list:
+      make_read_only(os.path.join(root, dir))
+    for file_ in file_list:
+      make_read_only(os.path.join(root, file_))