[PHP-WEBMASTER] [web-downloads] main: Make published SBOM metadata readable

[Shivam Mathur]

Author: Shivam Mathur (shivammathur)
Date: 2026-07-26T14:57:34+05:30

Commit: 
https://github.com/php/web-downloads/commit/6ff38e79ebde84ff5dd17501eafd0fcefb8f3504
Raw diff: 
https://github.com/php/web-downloads/commit/6ff38e79ebde84ff5dd17501eafd0fcefb8f3504.diff

Make published SBOM metadata readable

Changed paths:
  M  src/Console/Command/SeriesUpdateCommand.php
  M  tests/Console/Command/SeriesUpdateCommandTest.php


Diff:

diff --git a/src/Console/Command/SeriesUpdateCommand.php 
b/src/Console/Command/SeriesUpdateCommand.php
index 715fd0e..bd809a1 100644
--- a/src/Console/Command/SeriesUpdateCommand.php
+++ b/src/Console/Command/SeriesUpdateCommand.php
@@ -137,6 +137,7 @@ private function publishSbomMetadata(array $data): void
                     $temporary,
                     json_encode($metadata, JSON_THROW_ON_ERROR | 
JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n"
                 ) === false
+                || !chmod($temporary, 0644)
                 || !rename($temporary, $destination)) {
             throw new Exception("Could not publish '$destination'");
         }
diff --git a/tests/Console/Command/SeriesUpdateCommandTest.php 
b/tests/Console/Command/SeriesUpdateCommandTest.php
index 4ec4738..863a136 100644
--- a/tests/Console/Command/SeriesUpdateCommandTest.php
+++ b/tests/Console/Command/SeriesUpdateCommandTest.php
@@ -327,6 +327,7 @@ public function testPublishesSbomMetadata(): void
         $this->assertSame(0, $command->handle());
         $destination = $this->baseDirectory . '/php-sdk/sbom/php-8.2.json';
         $this->assertFileExists($destination);
+        $this->assertSame(0644, fileperms($destination) & 0777);
         $metadata = json_decode(file_get_contents($destination), true, 512, 
JSON_THROW_ON_ERROR);
         $this->assertSame('PHP-3.01', $metadata['license']);
         $this->assertSame('pcre2lib', $metadata['components'][0]['name']);