Signed image derivatives are written with mode 0600 and then return 403

🤖 Generated with the help of an LLM, reviewed and approved by me before posting.

Problem/Motivation

With "Add Manifests" on for image derivatives, the signed file is left with mode 0600. When PHP-FPM and the web server run as different users, the web server cannot read it.

Steps to reproduce

1. Enable "Add Manifests" for derivatives. Run PHP-FPM and nginx as different users.
2. Request /sites/default/files/styles/e2e_meta_jpg/public/e2e-plain.png. It returns 200, because PHP streams it.
3. Run stat -c %a on the file. It prints 600.
4. Request the URL again. The web server answers 403 Forbidden.

With the option off the mode is 664. An unmarked image behaves the same.

Seen with 1.4.11, c2patool 0.9.12, Drupal 11.4.

Proposed resolution

C2paSignSubscriber.php:287 signs in place. In c2patool, Signer.php:234 runs rename() of the temp output over the derivative. Afterwards call \Drupal::service('file_system')->chmod($derivative_uri).