From 39f214f14c1e0e945ad774e6aa3d7630bc0fc694 Mon Sep 17 00:00:00 2001
From: pctablet505 <pctablet505@gmail.com>
Date: Thu, 16 Jul 2026 21:57:17 +0530
Subject: [PATCH 1/2] Fix wheel file permissions being too restrictive

make_wheel_in() builds the wheel in a temporary file created by
tempfile.mkstemp(), which sets permissions to 0600. This mode was
never relaxed before the file was renamed into place, so built wheels
ended up mode 0600 instead of a normal, world-readable 0644.

Normalize the temp file's permissions with the existing
normalize_file_permissions() helper before renaming it to the final
wheel path, matching how files inside the wheel are already
normalized.

Fixes #804
---
 flit_core/flit_core/wheel.py       |  6 ++++++
 flit_core/tests_core/test_wheel.py | 16 ++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/flit_core/flit_core/wheel.py b/flit_core/flit_core/wheel.py
index 54d7cc1e..4f64adff 100644
--- a/flit_core/flit_core/wheel.py
+++ b/flit_core/flit_core/wheel.py
@@ -222,6 +222,12 @@ def make_wheel_in(ini_path, wheel_directory, editable=False):
             wb = WheelBuilder.from_ini_path(ini_path, fp)
             wb.build(editable)
 
+        # mkstemp() creates the file with mode 0600, which is too strict
+        # for a build artifact - normalize it like the files inside the
+        # wheel are normalized.
+        st_mode = os.stat(temp_path).st_mode
+        os.chmod(temp_path, common.normalize_file_permissions(st_mode))
+
         wheel_path = wheel_directory / wb.wheel_filename
         os.replace(temp_path, str(wheel_path))
     except:
diff --git a/flit_core/tests_core/test_wheel.py b/flit_core/tests_core/test_wheel.py
index b8326270..ae77564b 100644
--- a/flit_core/tests_core/test_wheel.py
+++ b/flit_core/tests_core/test_wheel.py
@@ -1,6 +1,10 @@
+import os
+import stat
+import sys
 from pathlib import Path
 from zipfile import ZipFile
 
+import pytest
 from testpath import assert_isfile
 
 from flit_core.wheel import make_wheel_in, main
@@ -53,3 +57,15 @@ def test_license_files(tmp_path):
     with ZipFile(info.file, 'r') as zf:
         assert 'module1-0.1.dist-info/licenses/LICENSE' in zf.namelist()
         assert 'module1-0.1.dist-info/licenses/module/vendor/LICENSE_VENDOR' in zf.namelist()
+
+
+@pytest.mark.skipif(sys.platform == 'win32', reason='Windows does not have Unix file permissions')
+def test_wheel_file_permissions(tmp_path):
+    # mkstemp(), which is used to create the wheel before it's renamed to
+    # its final name, creates files with mode 0600. The built wheel file
+    # itself should not be left that restrictive. Regression test for
+    # https://github.com/pypa/flit/issues/804
+    info = make_wheel_in(samples_dir / 'pep621' / 'pyproject.toml', tmp_path)
+    assert_isfile(info.file)
+    mode = stat.S_IMODE(os.stat(info.file).st_mode)
+    assert mode & 0o777 == 0o644, oct(mode)

From 15bc930f8b89d35ad6d8062433e2e6bdbfbb93f3 Mon Sep 17 00:00:00 2001
From: pctablet505 <pctablet505@gmail.com>
Date: Thu, 16 Jul 2026 22:31:54 +0530
Subject: [PATCH 2/2] Add changelog entry for wheel permissions fix

Add a Version 4.0.1 heading with a release-notes bullet for the wheel
permissions fix, following the project's convention of giving each
bugfix a :ghpull: reference under its own version heading.
---
 doc/history.rst | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/history.rst b/doc/history.rst
index 2fea5482..a13131bc 100644
--- a/doc/history.rst
+++ b/doc/history.rst
@@ -1,6 +1,12 @@
 Release history
 ===============
 
+Version 4.0.3
+-------------
+
+- Fix built wheels being created with overly restrictive ``0600`` permissions
+  instead of the normal, world-readable ``0644`` (:ghpull:`806`).
+
 Version 4.0.2
 -------------