Merge pull request #121667 from Mic92/buildkite

nixos/buildkite-agents: fix race-condition when installing secrets
NixOS · Jun 1, 2021 · 846f44e · 846f44e
2 parents 4a41a22 + 503b937
commit 846f44e
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/nixos/modules/services/continuous-integration/buildkite-agents.nix b/nixos/modules/services/continuous-integration/buildkite-agents.nix
@@ -238,8 +238,7 @@ in
         in
           optionalString (cfg.privateSshKeyPath != null) ''
             mkdir -m 0700 -p "${sshDir}"
-            cp -f "${toString cfg.privateSshKeyPath}" "${sshDir}/id_rsa"
-            chmod 600 "${sshDir}"/id_rsa
+            install -m600 "${toString cfg.privateSshKeyPath}" "${sshDir}/id_rsa"
           '' + ''
             cat > "${cfg.dataDir}/buildkite-agent.cfg" <<EOF
             token="$(cat ${toString cfg.tokenPath})"