The config file is used to store authentication tokens, so should not be readable by other users.
Hi @mavit, thanks for the change. The issue, you came up with, is valid. But there is a sad thing: I support rpkg in some very old releases that still run in Python2.7 environment. And there is a small possibility this code will be executed there (it is not just fedpkg). I had to use os.chmod instead.
os.chmod
Commit e71dad3b fixes this pull-request
Pull-Request has been merged by onosek
The config file is used to store authentication tokens, so should not be readable by other users.