1 files changed, 18 insertions, 9 deletions
diff --git a/packaging/build/build-hub.sh b/packaging/build/build-hub.sh
index 45d2ab9..be2d363 100755
--- a/packaging/build/build-hub.sh
+++ b/packaging/build/build-hub.sh
@@ -53,17 +53,26 @@ if [ -f "$REPO/packages/meshbay-hub/alembic.ini" ]; then
     cp "$REPO/packages/meshbay-hub/alembic.ini" "$ROOT/opt/meshbay-hub/migrations/"
 fi
 
-# Config example
+# Config example.
+#
+# A hard failure, not an `if [ -f ]`. This was a silent skip against a path
+# that did not exist, so every package built shipped no example config at all
+# and said nothing about it — and the postinst places no config either, on
+# purpose, which left an installed hub with nothing to copy from.
+EXAMPLE="$REPO/packaging/conf/hub.toml.example"
+[ -f "$EXAMPLE" ] || { echo "!! missing $EXAMPLE" >&2; exit 1; }
 mkdir -p "$ROOT/opt/meshbay-hub/share"
-if [ -f "$REPO/packaging/conf/hub.toml.example" ]; then
-    cp "$REPO/packaging/conf/hub.toml.example" "$ROOT/opt/meshbay-hub/share/"
-fi
+install -m 644 "$EXAMPLE" "$ROOT/opt/meshbay-hub/share/"
 
-# Also install to /etc/meshbay/ for discoverability
-mkdir -p "$ROOT/etc/meshbay"
-if [ -f "$ROOT/opt/meshbay-hub/share/hub.toml.example" ]; then
-    cp "$ROOT/opt/meshbay-hub/share/hub.toml.example" "$ROOT/etc/meshbay/"
-fi
+# Also next to the real config, where an operator looks first. Never
+# hub.toml itself: an upgrade would overwrite a working deployment.
+#
+# Modes are set here rather than left to the builder's umask, which decided
+# them until now — 775/664 on a machine with umask 002, 755/644 on one with
+# 022, from the same source tree. The postinst tightens the directory too, but
+# that then repairs the package instead of the package being right.
+install -d -m 750 "$ROOT/etc/meshbay"
+install -m 644 "$ROOT/opt/meshbay-hub/share/hub.toml.example" "$ROOT/etc/meshbay/"
 
 # --- Systemd unit ---------------------------------------------------------
 mkdir -p "$ROOT/usr/lib/systemd/system"