From 9c45cb3e478a519182a7d9bf48af1529b2ccc457 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 31 Oct 2026 05:28:26 +0100
Subject: move warn_if_readable_by_others to files module

---
 src/files.rs                   | 21 +++++++++++++++++++++
 src/identity.rs                |  2 +-
 src/swarm/auth.rs              | 23 +----------------------
 src/transport/libp2p/config.rs |  2 +-
 4 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/src/files.rs b/src/files.rs
index e27bde6..cd2f38c 100644
--- a/src/files.rs
+++ b/src/files.rs
@@ -167,6 +167,27 @@ fn sync_parent(path: &Path) {
     }
 }
 
+/// A key is a secret: a file others may read is worth a warning (not an error: a
+/// group may be deliberate, e.g. shared with a deployment tool). `what`: which key.
+pub(crate) fn warn_if_readable_by_others(path: &Path, what: &str) {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        if let Ok(metadata) = std::fs::metadata(path) {
+            let mode = metadata.permissions().mode();
+            if mode & 0o077 != 0 {
+                tracing::warn!(
+                    path = %path.display(),
+                    mode = format!("{:o}", mode & 0o777),
+                    "The {what} file is readable by others than its owner; chmod 600 it"
+                );
+            }
+        }
+    }
+    #[cfg(not(unix))]
+    let _ = (path, what);
+}
+
 fn with_suffix(path: &Path, suffix: &str) -> PathBuf {
     let mut name = path.as_os_str().to_owned();
     name.push(suffix);
diff --git a/src/identity.rs b/src/identity.rs
index 96e524e..8efe30f 100644
--- a/src/identity.rs
+++ b/src/identity.rs
@@ -48,7 +48,7 @@ impl NodeKey {
                     .with_context(|| format!("Reading the node key from {}", path.display()));
             }
         };
-        crate::swarm::auth::warn_if_readable_by_others(path, "node key");
+        crate::files::warn_if_readable_by_others(path, "node key");
         let Ok(seed) = <[u8; KEY_BYTES]>::try_from(bytes.as_slice()) else {
             bail!(
                 "The node key in {} has {} bytes; a node key has {KEY_BYTES}",
diff --git a/src/swarm/auth.rs b/src/swarm/auth.rs
index 50e2fae..534a64d 100644
--- a/src/swarm/auth.rs
+++ b/src/swarm/auth.rs
@@ -40,27 +40,6 @@ struct Rejections {
     suppressed: u64,
 }
 
-/// A key is a secret: a file others may read is worth a warning (not an error: a
-/// group may be deliberate, e.g. shared with a deployment tool). `what`: which key.
-pub(crate) fn warn_if_readable_by_others(path: &Path, what: &str) {
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt;
-        if let Ok(metadata) = std::fs::metadata(path) {
-            let mode = metadata.permissions().mode();
-            if mode & 0o077 != 0 {
-                tracing::warn!(
-                    path = %path.display(),
-                    mode = format!("{:o}", mode & 0o777),
-                    "The {what} file is readable by others than its owner; chmod 600 it"
-                );
-            }
-        }
-    }
-    #[cfg(not(unix))]
-    let _ = (path, what);
-}
-
 /// At most one rejection log line per this interval.
 const REJECTION_LOG_INTERVAL: Duration = Duration::from_secs(10);
 
@@ -70,7 +49,7 @@ impl SwarmKey {
     pub(crate) fn from_file(path: &Path) -> Result<Self> {
         let key = std::fs::read(path)
             .with_context(|| format!("Reading the swarm key from {}", path.display()))?;
-        warn_if_readable_by_others(path, "swarm key");
+        crate::files::warn_if_readable_by_others(path, "swarm key");
         if key.len() < 16 {
             bail!(
                 "The swarm key in {} has {} bytes; use at least 16 (32 random bytes recommended)",
diff --git a/src/transport/libp2p/config.rs b/src/transport/libp2p/config.rs
index 012999d..719f2e8 100644
--- a/src/transport/libp2p/config.rs
+++ b/src/transport/libp2p/config.rs
@@ -103,7 +103,7 @@ impl Libp2pConfig {
         };
         let mut bytes = std::fs::read(path)
             .with_context(|| format!("Reading the libp2p key from {}", path.display()))?;
-        crate::swarm::auth::warn_if_readable_by_others(path, "libp2p key");
+        crate::files::warn_if_readable_by_others(path, "libp2p key");
         if bytes.len() != 32 {
             bail!(
                 "The libp2p key in {} has {} bytes; it has 32",
-- 
cgit v1.3.1