Seal catalog publication Git metadata

tools/release/govoplan_release/publisher.py

@@ -614,6 +614,14 @@ def publish_catalog_candidate(
             effective_tag_name,
             publication_commit,
         )
+        _seal_git_metadata_file(
+            resolved_web_root
+            / ".git"
+            / "refs"
+            / "tags"
+            / effective_tag_name,
+            label="website publication tag reference",
+        )
         publication_tag_object = git_text(
             resolved_web_root,
             "rev-parse",
@@ -1445,9 +1453,38 @@ def commit_publication_tree(
         frozen_head,
     )
     _git_checked(web_root, "read-tree", "--reset", commit_sha)
+    _seal_git_metadata_file(
+        web_root / ".git" / "refs" / "heads" / branch,
+        label="website branch reference",
+    )
+    _seal_git_metadata_file(
+        web_root / ".git" / "index",
+        label="website Git index",
+    )
     return commit_sha
 
 
+def _seal_git_metadata_file(path: Path, *, label: str) -> None:
+    try:
+        metadata = path.lstat()
+        if (
+            stat.S_ISLNK(metadata.st_mode)
+            or not stat.S_ISREG(metadata.st_mode)
+            or metadata.st_uid != os.geteuid()
+        ):
+            raise RuntimeError(f"{label} is not an operator-owned regular file")
+        os.chmod(path, 0o600, follow_symlinks=False)
+        sealed = path.lstat()
+    except OSError as exc:
+        raise RuntimeError(f"{label} cannot be sealed") from exc
+    if (
+        not stat.S_ISREG(sealed.st_mode)
+        or sealed.st_uid != os.geteuid()
+        or stat.S_IMODE(sealed.st_mode) != 0o600
+    ):
+        raise RuntimeError(f"{label} was not sealed to operator-only access")
+
+
 def verify_committed_publication(
     *,
     web_root: Path,
@@ -1948,6 +1985,8 @@ def _git_bytes(
             "-C",
             str(path),
             "-c",
+            "core.sharedRepository=0600",
+            "-c",
             "core.fsmonitor=false",
             "-c",
             "core.hooksPath=/dev/null",