As M. Ahern points out at https://news.ycombinator.com/item?id=23098813 https://news.ycombinator.com/item?id=23098813 , that's only part of the job. Assuming t

As M. Ahern points out at https://news.ycombinator.com/item?id=23098813 https://news.ycombinator.com/item?id=23098813 , that's only part of the job. Assuming that you actually use rename() to do the unlinking and atomic updating, the "make install" should also ensure that write permission is removed from the new files. * https://github.com/jdebp/nosh/blob/79b1c0aab9834a09a59e15d47710f355c5c0417a/package/makeinstall#L30 https://github.com/jdebp/nosh/blob/79b1c0aab9834a09a59e15d47...