fsutil

func EnsurePrivateDir ¶ added in v0.17.0

func EnsurePrivateDir(path string) error

EnsurePrivateDir creates path as a real owner-only directory (0700). An existing directory that grants group or other access is tightened to 0700. Symlinks and non-directories fail rather than being followed or replaced.

Parent directories may still be created with MkdirAll. The final component is created, inspected, and chmod'd through a parent-directory handle using no-follow operations, so a replacement symlink cannot redirect those mutations. Intermediate path components may be symlinks (required on platforms where /tmp or /var is a symlink).

func SyncDir ¶ added in v0.16.0

func SyncDir(dir string) error

SyncDir fsyncs a directory so renames inside it survive a crash. Callers that publish content with rename rather than WriteFileAtomic use it to make the swap durable before recording state that depends on it.

func WriteFileAtomic ¶

func WriteFileAtomic(path string, data []byte, perm os.FileMode) error

WriteFileAtomic writes data to path using a temp file and atomic rename. perm sets the file mode applied to the final file.

func WriteFileAtomicIfChanged ¶ added in v0.17.0

func WriteFileAtomicIfChanged(path string, data []byte, perm os.FileMode) error

WriteFileAtomicIfChanged preserves an existing regular file when both its bytes and mode already match. Avoiding an otherwise-identical rename keeps file watchers from treating a no-op generation pass as a configuration change. Missing files, symlinks, directories, and mode changes still flow through WriteFileAtomic.