Make sure permissions of saved files adhere to umask setting

[osma]

Fixes #829

Many types of files saved by Annif using the atomic_save() operation had tighter permissions than expected. This is because they were first saved as temporary files, then renamed.

This PR makes sure that the file permissions respect the umask setting. The unit test verifies that this works using different commonly used umask values.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.63%. Comparing base (e491b3f) to head (1087b58).
Report is 9 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #832   +/-   ##
=======================================
  Coverage   99.63%   99.63%           
=======================================
  Files          95       96    +1     
  Lines        7182     7217   +35     
=======================================
+ Hits         7156     7191   +35     
  Misses         26       26           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[juhoinkinen]

I quickly trained some projects with the code in this PR, and noted that while atomic_save() now behaves as expected permission-wise, the nn-train.mdb/ directory and the files in it (created by NN ensemble backend) does not get the permissions following umask; e.g. with umask for read-write for group, 0007, the write bit is missing:

$ ls -ld data-tmp/./projects/nn-ensemble-fi/nn-train.mdb/
drwxr-x--- 2 <myuser> <mygroup>  4096 Feb  4 17:17 data-tmp/./projects/nn-ensemble-fi/nn-train.mdb/

$ ls -l data-tmp/./projects/nn-ensemble-fi/nn-train.mdb/
total 124
-rw-r----- 1 <myuser> <mygroup> 1073741824 Feb  4 17:17 data.mdb
-rw-r----- 1 <myuser> <mygroup>                8192 Feb  4 17:17 lock.mdb

I wonder if there is something that can be done for this too...?

Otherwise LGTM!

[juhoinkinen]

It looks like lmdb.open() could uses a mode argument, which by default is O_0755. Maybe this could be get from the umask.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud