better permission warnings

bin/terractl

@@ -229,7 +229,8 @@ install_server() {
 
   command -v unzip >/dev/null || die "unzip is not installed"
   zip=$(pick_zip)
-  [[ -r $zip ]] || die "cannot read $zip"
+  [[ -e $zip ]] || die "$zip not found"
+  [[ -r $zip ]] || die "the '$SVC_USER' user can't read $zip; fix it with: sudo chmod 644 $zip"
   log "installing $TYPE from $(basename "$zip") into $dir/server"
 
   EXTRACT_TMP=$(mktemp -d "$dir/.extract.XXXXXX")
@@ -1049,6 +1050,36 @@ cmd_enable() {
   fi
 }
 
+# Can the service user read <file>? Worked out from the file's owner, group and
+# mode, because whoever runs terractl may be someone else.
+svc_can_read() {
+  local owner group mode
+  read -r owner group mode < <(stat -c '%U %G %a' "$1" 2>/dev/null) || return 1
+  if [[ $owner == "$SVC_USER" ]]; then (( 8#$mode & 0400 ))
+  elif [[ $group == "$SVC_USER" ]]; then (( 8#$mode & 0040 ))
+  else (( 8#$mode & 0004 )); fi
+}
+
+# Zips in dist/ the servers can't unpack, e.g. copied in with 'scp -p' from a
+# private file. Instances fail on their first start with such a zip.
+unreadable_zips() {
+  local f
+  for f in "$DIST_DIR"/*.zip; do
+    if [[ -f $f ]] && ! svc_can_read "$f"; then echo "$f"; fi
+  done
+}
+
+zip_warning() {
+  local where=""
+  local -a bad=()
+  mapfile -t bad < <(unreadable_zips)
+  [[ ${#bad[@]} -gt 0 ]] || return 0
+  if [[ -n ${TERRACTL_VIA:-} ]]; then where=" (on $(hostname 2>/dev/null || echo that host))"; fi
+  log "warning: the '$SVC_USER' user can't read these zips, so servers can't be installed from them:"
+  printf '  %s\n' "${bad[@]}" >&2
+  log "fix it with$where: sudo chmod 644 ${bad[*]@Q}"
+}
+
 cmd_list() {
   local d n port boot state
   printf '%-20s %-11s %-6s %-9s %s\n' INSTANCE TYPE PORT BOOT STATE
@@ -1065,6 +1096,7 @@ cmd_list() {
       printf '%-20s %-11s %-6s %-9s %s\n' "$n" "$TYPE" "${port:--}" "${boot:--}" "$state"
     ) 2>/dev/null || printf '%-20s %s\n' "$n" "(cannot read config - try sudo)"
   done
+  zip_warning
 }
 
 cmd_reinstall() {
@@ -1101,6 +1133,7 @@ cmd_info() {
     for f in "$DIST_DIR"/*.zip; do
       if [[ -f $f ]]; then echo "dist_zip=$(basename "$f")"; fi
     done
+    while IFS= read -r f; do echo "unreadable_zip=$(basename "$f")"; done < <(unreadable_zips)
     for f in "$BASE_DIR"/*/instance.conf; do
       if [[ -f $f ]]; then echo "instance=$(basename "$(dirname "$f")")"; fi
     done