Shared multi-user interpreter and environment

[Ma-Shell]

Hello!

I have the following setup:
There is an application which should be accessible by everyone who logs on to the PC. The application is located on a public path accessible by everyone (C:<MYAPP>). Since the environment requires some libraries, it might become quite large. I have added a hatch-configuration file, which specifies the data- and cache-directory also within that same folder as C:<MYAPP>.hatch. The idea is that everyone can just do hatch --config hatch.toml run main and re-use the same environment while modified dependencies would be synced automatically by whoever is executing it first.

On Windows, however, the file-permissions for the Python-interpreter installed by Hatch are set too restrictive and the directory is only accessible by the user who created it. Digging through the source-code I have found that this comes from Hatch extracting the distribution to a temporary directory, which per default is found in the user's Appdata directory and then moved to the location, where it is supposed to be. While moving, the restrictive permissions of the user's Appdata directory are kept. I found, that I can influence this behaviour by setting any of the TMPDIR, TEMP or TMP (https://docs.python.org/3/library/tempfile.html#tempfile.mkstemp) environment variables to a path that is accessible by everyone, so the temporary extraction-directory will be more premissible.

While this works, it depends on an implementation detail and might thus be subject to change. Furthermore, I suspect that this is actually a bug and not intended behavior, as the documentation of the mkdtemp-function actually specifies "The directory is readable, writable, and searchable only by the creating user ID".

On Windows 10 (not reproducible on Windows 11) there seems to be a similar issue with some files installed in the venv: I had numpy not being importable because some of the used libraries within the site-packages directory were not accessible. This problem was fixed by specifying a public uv-cache-dir in my pyproject.toml.

Ideally, I think, interpreter and environment should inherit the permissions of the folder where they live.