Allow chezmoi to manage `readonly`-type files and directories about chezmoi HOT 2 OPEN

It's possible I could work on a proof-of-concept to evaluate viability of this feature, if you would be interested.

Yes, I would be interested, but bear in mind that this is likely to be a significant amount of work and require deep changes to chezmoi's internals. Please describe how you propose to modify chezmoi to support this before starting significant work.

Fundamentally, this will require changes to how chezmoi performs updates, where the target state does not match the destination state. Specifically, currently chezmoi changes the permissions on each directory at most once. To implement the functionality requested in this PR, if a readonly_ directory requires changes then chezmoi would have to modify the directory to allow writes, update the directory's children, and then modify the directory to disallow writes. i.e., chezmoi would have to be modified to visit directories twice, not once.

Another consideration is that if the update phase is interrupted then the directory may be left in the wrong state.

from chezmoi.

For convenience, here is a Dockerfile that will quickly demonstrate the issue:

FROM debian:12-slim

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y curl && apt-get clean

RUN sh -c "$(curl -fsLS get.chezmoi.io)"

RUN useradd -m user
USER user

RUN :\
  && export source="$(chezmoi source-path)" \
  && chezmoi init \
  && mkdir "$source/readonly_test_dir" \
  && echo foo >"$source/readonly_test_dir/foo" \
  && chezmoi apply \
  && echo bar >"$source/readonly_test_dir/bar" \
  && chezmoi apply

# Output: chezmoi: open /home/user/test_dir/.foo8977729695619710040: permission denied

To run:

docker build --no-cache --progress=plain -t chezmoi-issue-3441 . && docker run -it --rm chezmoi-issue-3441

from chezmoi.