fix(vmtest): protect credentials in result file

pkg/vmtest/result.go

@@ -150,7 +150,7 @@ func (r *Result) pass() {
 const ResultFile = "result.json"
 
 // Write saves the result. Called even when the run failed — especially then.
-func (r *Result) Write(dir string) (string, error) {
+func (r *Result) Write(dir string) (path string, retErr error) {
 	r.Finished = time.Now()
 	if r.Status == "" {
 		// A run that neither passed nor failed crashed somewhere that did not
@@ -163,12 +163,26 @@ func (r *Result) Write(dir string) (string, error) {
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return "", err
 	}
-	path := filepath.Join(dir, ResultFile)
+	path = filepath.Join(dir, ResultFile)
 	data, err := json.MarshalIndent(r, "", "  ")
 	if err != nil {
 		return "", err
 	}
-	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	if err != nil {
+		return "", err
+	}
+	defer func() {
+		if err := f.Close(); err != nil && retErr == nil {
+			retErr = err
+		}
+	}()
+	// OpenFile does not change the mode of an existing result. Correct it before
+	// writing because the JSON may contain the password for a still-running VM.
+	if err := f.Chmod(0o600); err != nil {
+		return "", err
+	}
+	if _, err := f.Write(append(data, '\n')); err != nil {
 		return "", err
 	}
 	return path, nil

pkg/vmtest/result_test.go

@@ -49,6 +49,26 @@ func TestResultWrite(t *testing.T) {
 	}
 }
 
+func TestResultWrite_PrivateEvenWhenReplacingPermissiveFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ResultFile)
+	if err := os.WriteFile(path, []byte("old report\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	result := &Result{Name: "gate", SSH: SSHAccess{Password: "guest-password"}}
+	if _, err := result.Write(dir); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Errorf("result mode = %04o, want 0600", got)
+	}
+}
+
 func TestResultWrite_AVerdictlessRunIsAFailure(t *testing.T) {
 	// A run that returned without setting a verdict crashed somewhere. Reporting
 	// it as blank would let a pipeline read it as success.