Add $LXMOD NTFS extended attribute support for executable files

[Copilot]

• Understand current implementation of xbit in ImplFileUtils.cs
• Add constant for $LXMOD extended attribute name
• Modify IsExecutable() to check both xbit and $LXMOD
• Modify SetExecutable() to write both xbit and $LXMOD
• Add helper methods for parsing/creating $LXMOD format
• Run existing tests to ensure compatibility (all 671 tests pass)
• Add tests for $LXMOD support (6 new tests added)
• Fix octal literal syntax (use decimal equivalents for older C# versions)
• Preserve existing $LXMOD permissions when setting executable bit
• Add test to verify permission preservation
• All 671 tests pass (47 skipped Windows-specific tests)
• Run code review
• Run security checks

Summary

Successfully extended ImplFileUtils.cs to use $LXMOD NTFS extended attribute for marking executable files, in addition to the existing xbit. When writing, both attributes are set. When reading, either can indicate executable bit. The implementation now preserves existing $LXMOD permissions when setting the executable bit, only modifying the owner execute bit.

Original prompt

On ImplFileUtils.cs, Extend src/Store/FileSystem/ImplFileUtils.cs to use $LXMOD NTFS extended attribute for marking executable files, in addition to the existing xbit.

When writing, set both. When reading, either can indicate executable bit.

Unlike xbit, which is just a boolean, $LXMOD contains Unix permission octals and type, e.g: 0777.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[bastianeicher]

When setting or unsetting the executable bit, if there is already a value for $LXMOD the parts other than the executable bit should be preserved.

[Copilot]

When setting or unsetting the executable bit, if there is already a value for $LXMOD the parts other than the executable bit should be preserved.

Fixed in 6cd53bb. SetExecutable() now reads any existing $LXMOD value, preserves all permission bits, and only sets the owner execute bit (0x40) using bitwise OR. Added test to verify permissions are preserved when setting executable bit on a file with existing $LXMOD (0666 → 0766).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 224.0.0.251
  • Triggering command: REDACTED, pid is -1 (packet block)
• example
  • Triggering command: /home/REDACTED/.cache/0install.net/implementations/sha256new_6CF3DO2NLC3BRS23NYAURNGGKWZOGMSR43Z7WHRRMCSPPHW2OEVQ/dotnet /home/REDACTED/.cache/0install.net/implementations/sha256new_6CF3DO2NLC3BRS23NYAURNGGKWZOGMSR43Z7WHRRMCSPPHW2OEVQ/dotnet exec --runtimeconfig /home/REDACTED/work/0install-dotnet/0install-dotnet/src/UnitTests/bin/Release/net9.0/ZeroInstall.UnitTests.runtimeconfig.json --depsfile /home/REDACTED/work/0install-dotnet/0install-dotnet/src/UnitTests/bin/Release/net9.0/ZeroInstall.UnitTests.deps.json /home/REDACTED/work/0install-dotnet/0install-dotnet/src/UnitTests/bin/Release/net9.0/testhost.dll --port 42685 --endpoint 127.0.0.1:042685 --role client --parentprocessid 7376 --telemetryoptedin false (dns block)
• invalid
  • Triggering command: /home/REDACTED/.cache/0install.net/implementations/sha256new_6CF3DO2NLC3BRS23NYAURNGGKWZOGMSR43Z7WHRRMCSPPHW2OEVQ/dotnet /home/REDACTED/.cache/0install.net/implementations/sha256new_6CF3DO2NLC3BRS23NYAURNGGKWZOGMSR43Z7WHRRMCSPPHW2OEVQ/dotnet exec --runtimeconfig /home/REDACTED/work/0install-dotnet/0install-dotnet/src/UnitTests/bin/Release/net9.0/ZeroInstall.UnitTests.runtimeconfig.json --depsfile /home/REDACTED/work/0install-dotnet/0install-dotnet/src/UnitTests/bin/Release/net9.0/ZeroInstall.UnitTests.deps.json /home/REDACTED/work/0install-dotnet/0install-dotnet/src/UnitTests/bin/Release/net9.0/testhost.dll --port 42685 --endpoint 127.0.0.1:042685 --role client --parentprocessid 7376 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)