Merge branch 'tb/commit-graph-perm-bits'

Some of the files commit-graph subsystem keeps on disk did not
correctly honor the core.sharedRepository settings and some were
left read-write.

* tb/commit-graph-perm-bits:
  commit-graph.c: make 'commit-graph-chain's read-only
  commit-graph.c: ensure graph layers respect core.sharedRepository
  commit-graph.c: write non-split graphs as read-only
  lockfile.c: introduce 'hold_lock_file_for_update_mode'
  tempfile.c: introduce 'create_tempfile_mode'

diff --cc commit-graph.c
Simple merge

diff --cc t/t5318-commit-graph.sh
Simple merge

diff --cc t/t5324-split-commit-graph.sh
index 594edb7307edf6cb0e1c0ea2723bff29d359a9c5,cff5a41f48d01086cdc917dd1e9dc4c1090f1ec0..269d0964a3e0b51bceffe0362f45f5c0a8bd229c
--- 1/t/t5324-split-commit-graph.sh
--- 2/t/t5324-split-commit-graph.sh
+++ b/t/t5324-split-commit-graph.sh
@@@ -358,47 -355,24 +362,67 @@@ test_expect_success 'split across alter
        test_cmp commit-graph .git/objects/info/commit-graph
  '
  
 +test_expect_success '--split=no-merge always writes an incremental' '
 +      test_when_finished rm -rf a b &&
 +      rm -rf $graphdir $infodir/commit-graph &&
 +      git reset --hard commits/2 &&
 +      git rev-list HEAD~1 >a &&
 +      git rev-list HEAD >b &&
 +      git commit-graph write --split --stdin-commits <a &&
 +      git commit-graph write --split=no-merge --stdin-commits <b &&
 +      test_line_count = 2 $graphdir/commit-graph-chain
 +'
 +
 +test_expect_success '--split=replace replaces the chain' '
 +      rm -rf $graphdir $infodir/commit-graph &&
 +      git reset --hard commits/3 &&
 +      git rev-list -1 HEAD~2 >a &&
 +      git rev-list -1 HEAD~1 >b &&
 +      git rev-list -1 HEAD >c &&
 +      git commit-graph write --split=no-merge --stdin-commits <a &&
 +      git commit-graph write --split=no-merge --stdin-commits <b &&
 +      git commit-graph write --split=no-merge --stdin-commits <c &&
 +      test_line_count = 3 $graphdir/commit-graph-chain &&
 +      git commit-graph write --stdin-commits --split=replace <b &&
 +      test_path_is_missing $infodir/commit-graph &&
 +      test_path_is_file $graphdir/commit-graph-chain &&
 +      ls $graphdir/graph-*.graph >graph-files &&
 +      test_line_count = 1 graph-files &&
 +      verify_chain_files_exist $graphdir &&
 +      graph_read_expect 2
 +'
 +
 +test_expect_success ULIMIT_FILE_DESCRIPTORS 'handles file descriptor exhaustion' '
 +      git init ulimit &&
 +      (
 +              cd ulimit &&
 +              for i in $(test_seq 64)
 +              do
 +                      test_commit $i &&
 +                      test_might_fail run_with_limited_open_files git commit-graph write \
 +                              --split=no-merge --reachable || return 1
 +              done
 +      )
 +'
 +
+ while read mode modebits
+ do
+       test_expect_success POSIXPERM "split commit-graph respects core.sharedrepository $mode" '
+               rm -rf $graphdir $infodir/commit-graph &&
+               git reset --hard commits/1 &&
+               test_config core.sharedrepository "$mode" &&
+               git commit-graph write --split --reachable &&
+               ls $graphdir/graph-*.graph >graph-files &&
+               test_line_count = 1 graph-files &&
+               echo "$modebits" >expect &&
+               test_modebits $graphdir/graph-*.graph >actual &&
+               test_cmp expect actual &&
+               test_modebits $graphdir/commit-graph-chain >actual &&
+               test_cmp expect actual
+       '
+ done <<\EOF
+ 0666 -r--r--r--
+ 0600 -r--------
+ EOF
+ 
  test_done