internal/securefile/securefile.go

// Package securefile writes credential-bearing files with owner-only access.
package securefile

import (
	"io"
	"os"
)

// WriteFile writes data to path and enforces mode 0600 even when path already
// exists with broader permissions.
func WriteFile(path string, data []byte) (err error) {
	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE, 0o600)
	if err != nil {
		return err
	}
	defer func() {
		if closeErr := f.Close(); err == nil {
			err = closeErr
		}
	}()

	if err := f.Chmod(0o600); err != nil {
		return err
	}
	if err := f.Truncate(0); err != nil {
		return err
	}
	if _, err := f.Seek(0, 0); err != nil {
		return err
	}
	if n, err := f.Write(data); err != nil {
		return err
	} else if n != len(data) {
		return io.ErrShortWrite
	}
	return nil
}