pub fn store_device_keys(path: &Path, keys: &DeviceKeys) -> Result<()>Expand description
Replace the stored keys, 0600, atomically.
Written to a sibling temporary file and renamed, so a crash mid-write leaves the previous roster rather than a truncated one: a half-written file is a listener that admits some devices and not others, with nothing saying which.
The temporary file is 0600 from the moment it exists, not from a chmod
once the keys are already in it; create_private says why. A temporary a
crash leaves behind is therefore no more readable than the file it would
have replaced, and it is not swept here: another process may be mid-write
on a temporary of its own, and deleting that one brings back the rename
collision the per-writer names below exist to prevent. The one exception
is a leftover under this writer’s own name, which create_private removes.
The temporary file is named per writer, not per path. A fixed
.tmp sibling makes two concurrent writers collide on one filename:
both write it, the first renames it away, and the second fails at its own
rename with NotFound — an error raised for a write that was perfectly
valid. The rename is what makes this atomic, and it only does so if each
writer has its own thing to rename.
§Errors
io::Error from creating the directory, creating or writing the
temporary file, removing a leftover under its name, setting its mode, or
the rename.