File permissions for cache shared between multiple users

[mikapfl]

What's the problem this feature will solve?

On a shared Linux system, we want to share pip's cache between multiple users, so packages are not downloaded 50 times when 50 users install the same package.

Currently on unix, when I set the cache directory to a directory which is readable and writable by a group and has the setgid bit set, the cache folders are created with permissions suitable for group-use when I set a correct umask (so, with umask 0002, I get permissions drwxrwsr-x on the http folder and its subfolders). However, all cache files are only readable and writable by the user who downloaded the file in question last. So, if the same user installs the same package multiple times, everything is nicely cached, but if another user installs the same package, it is not cached.

As far as understand, this happens because adjacent_tmp_file uses NamedTemporaryFile which has file mode 0o600 hard coded for security reasons, irrespective of the umask.

Describe the solution you'd like

Ideally, a config option would be added which uses settings suitable for shared caches, something like cache-shared=True or cache-shared-group=my-shared-group-name or so.

Alternative Solutions

We could probably run a chmod periodically or something like this, but if it doesn't happen within pip itself, there will always be a delay between when the cache is created and when the cache is available for all users.

Additional context

If the feature was generally welcome, I could also develop a pull request.

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[uranusjr]

Or I guess once the file is committed (i.e. no longer temporary) its permission could be changed to match the cache directory. Not sure if that is a reasonable approach security-wise.

[numas]

Would love to see this implemented. Was initially happy to find the PIP_CACHE_DIR / PIP_DOWNLOAD_CACHE env vars while setting up a multi-user server for a university department, only to see that packages are downloaded again every time for each user. The shared folder has ACL set up but it is ignored by pip. I hope a solution can be made for a shared cache, as this use case (multi-user setup) is widespread and not having it is rather wasteful in both bandwidth and disk space.

[uranusjr]

Pull requests are always welcomed.