fix: normalize file modes in shared data and certs image layers

newDataTarball (the shared layer carrying the function source, static
files and the /func directory itself) and newCertsTarball copied on-disk
file modes into the image verbatim, overriding only Uid/Gid - the same
issue fixed for the python lib layer in the previous commit.

For Go functions this is latent: the binary is self-contained and does
not read those files at runtime, so it "works" as long as the project
directory happens to be 0755 (the default under umask 022). But if the
project directory has a stricter mode (e.g. 0750/0700), /func is baked in
non-traversable and the container cannot reach /func/f under an arbitrary
UID (e.g. OpenShift's restricted SCC) - failing before main runs. It also
hardens the python source files shipped in this shared layer.

Normalize dirs and executables to 0755 and regular files to 0644 (leaving
symlink modes untouched), and force certs to 0644 so any UID (including
group 0) can traverse and read them. The go exec layer already forced
0755 (go_builder.go); this covers the remaining shared layers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: matejvasek

pkg/oci/builder.go

@@ -381,6 +381,21 @@ func newDataTarball(root, target string, ignored []string, verbose bool) error {
 		header.Name = slashpath.Join("/func", filepath.ToSlash(relPath))
 		header.Uid = DefaultUid
 		header.Gid = DefaultGid
+		// Normalize permissions so the image works on platforms that run
+		// containers with an arbitrary UID (e.g. OpenShift's restricted SCC).
+		// The on-disk mode is not portable: e.g. a project directory created
+		// under a stricter umask can be non-traversable by group/other, which
+		// would make /func (and thus /func/f) inaccessible to any UID other
+		// than the image's configured one. Directories and executables get
+		// 0755, regular files 0644. Symlink modes are not meaningful and are
+		// left untouched.
+		if info.Mode()&fs.ModeSymlink == 0 {
+			if info.IsDir() || info.Mode()&0o111 != 0 {
+				header.Mode = (header.Mode & ^int64(fs.ModePerm)) | 0o755
+			} else {
+				header.Mode = (header.Mode & ^int64(fs.ModePerm)) | 0o644
+			}
+		}
 
 		if err := tw.WriteHeader(header); err != nil {
 			return err
@@ -502,6 +517,9 @@ func newCertsTarball(source, target string, verbose bool) error {
 		header.Name = path
 		header.Uid = DefaultUid
 		header.Gid = DefaultGid
+		// Certs must be world-readable so any UID can read them (see the
+		// arbitrary-UID note in newDataTarball).
+		header.Mode = (header.Mode & ^int64(fs.ModePerm)) | 0o644
 
 		if err := tw.WriteHeader(header); err != nil {
 			return err

pkg/oci/builder_test.go

@@ -326,6 +326,85 @@ type fileInfo struct {
 	Linkname   string
 }
 
+// TestNewDataTarball_NormalizesModes ensures that the shared data layer
+// (function source, static files and the /func directory itself) is written
+// with portable permissions regardless of the on-disk modes.
+//
+// Regression test: the on-disk mode of the project directory and its files is
+// copied verbatim into the image layer. Under a strict umask that yields a
+// non-traversable /func, or files that are not world-readable, the resulting
+// image fails under an arbitrary UID (e.g. OpenShift's restricted SCC) because
+// a non-owner UID cannot traverse /func to reach /func/f (or read the files).
+// Directories and executables must be 0755 and regular files 0644; symlinks are
+// left untouched.
+func TestNewDataTarball_NormalizesModes(t *testing.T) {
+	root := t.TempDir()
+
+	if err := os.WriteFile(filepath.Join(root, "func.yaml"), []byte("x\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "run.sh"), []byte("#!/bin/sh\n"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	sub := filepath.Join(root, "sub")
+	if err := os.Mkdir(sub, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sub, "mod.py"), []byte("y\n"), 0o640); err != nil {
+		t.Fatal(err)
+	}
+	// Force a non-traversable project root, i.e. what the failure looks like.
+	if err := os.Chmod(root, 0o750); err != nil {
+		t.Fatal(err)
+	}
+	defer os.Chmod(root, 0o755) //nolint:errcheck // best effort for cleanup
+
+	target := filepath.Join(t.TempDir(), "data.tar.gz")
+	if err := newDataTarball(root, target, nil, false); err != nil {
+		t.Fatal(err)
+	}
+
+	modes := map[string]int64{}
+	f, err := os.Open(target)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	gr, err := gzip.NewReader(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer gr.Close()
+	tr := tar.NewReader(gr)
+	for {
+		hdr, err := tr.Next()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			t.Fatal(err)
+		}
+		modes[hdr.Name] = hdr.Mode & int64(fs.ModePerm)
+	}
+
+	assertMode := func(name string, want int64) {
+		t.Helper()
+		got, ok := modes[name]
+		if !ok {
+			t.Fatalf("entry %q not found in tarball; entries: %v", name, modes)
+		}
+		if got != want {
+			t.Errorf("entry %q has mode %#o, want %#o", name, got, want)
+		}
+	}
+
+	assertMode("/func", 0o755)         // the project root must be traversable
+	assertMode("/func/sub", 0o755)     // subdirs too
+	assertMode("/func/func.yaml", 0o644)
+	assertMode("/func/sub/mod.py", 0o644)
+	assertMode("/func/run.sh", 0o755)  // executables keep the execute bit
+}
+
 // TestBuilder_StaticEnvs ensures that certain "static" environment variables
 // comprising Function metadata are added to the config.
 func TestBuilder_StaticEnvs(t *testing.T) {