Samin061 opened a new pull request, #71766: URL: https://github.com/apache/airflow/pull/71766
The Teradata remote-execution paths write the tbuild script, the tdload job-variable file, and the BTEQ script to a local temp file before encrypting and transferring them, and each of those embeds the connection password (`UserPassword`/`TargetUserPassword` for TPT, `.LOGON <host>/<user>,<password>` for BTEQ). The local-execution siblings already restrict those files to the owner through `set_local_file_permissions`, but the three SSH paths left them at the process umask, so under a common umask the credential files are group- and world-readable on disk before transfer. This applies the same owner-only restriction at the three remote-execution sites and adds regression tests. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
