Bug report

Bug description:

python -m gzip derives the output name from the input name and opens it with "wb", so an existing symlink at that name is followed and its target is overwritten. It also creates the output with the default mode, so a private input file yields a world-readable output. gzip(1) (with -f) unlinks the old name, creates the output exclusively, and gives it the input's permission bits.

import gzip, os, subprocess, sys
open('target', 'wb').write(b'precious')
os.symlink('target', 'report')
with gzip.open('report.gz', 'wb') as f:
    f.write(b'payload')
subprocess.run([sys.executable, '-m', 'gzip', '-d', 'report.gz'])
print(open('target', 'rb').read())  # b'payload'

open('c.txt', 'wb').write(b'secret')
os.chmod('c.txt', 0o600)
subprocess.run([sys.executable, '-m', 'gzip', 'c.txt'])
print(oct(os.stat('c.txt.gz').st_mode & 0o777))  # 0o644 with umask 022

Expected report to be replaced by a regular file with target untouched, and c.txt.gz to be 0o600, as with gzip.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-161088: Make the gzip CLI replace its output file like gzip(1) #161089