Initial commit

umask_unix.go

@@ -0,0 +1,10 @@
+//go:build unix
+
+package main
+
+import "syscall"
+
+// setUmask makes the process's default permissions match what the data
+// directory is documented to use: group-writable, world-readable. The token
+// file overrides this explicitly, since it is the one thing that is secret.
+func setUmask() { syscall.Umask(0o002) }