pub fn write(path: impl AsRef<Path>, graph: &NirGraph) -> Result<()>Expand description
Write a NIR graph to a .nir (HDF5) path atomically.
Equivalent to write_with using WriteOptions::default (gzip level 4,
matching h5py).
Data is written to a temporary file inside a private staging directory
(mode 0700 on Unix), flushed, closed, and then atomically renamed over the
destination. A failed write leaves an existing destination unchanged.
Staging base (Unix): when the destination parent is untrusted —
group/world-writable without the sticky bit, a symlink path component, or
owned by a UID other than the process effective UID or root — staging
attempts to use sticky temp (if owned by the current user or root, writable,
and with verified symlink-free ancestry) or a private per-user runtime/cache
directory (if all ancestors are owned by the current user or root, non-symlink,
and free of non-sticky group/world-writable modes) so other local users cannot
rename the staging directory away and plant a path for the HDF5 reopen.
Foreign-owned parents are treated as untrusted even at mode 0755, because
the directory owner can always rename entries (including under a sticky bit).
If no safe staging base is found, the write fails rather than falling back to
the untrusted destination parent. The final replace into a multi-user
non-sticky parent still has residual rename races — prefer private destination
directories on shared hosts.
Existing Unix file permissions (mode bits) are preserved, but ownership
and group are changed to those of the writing process, and POSIX ACLs are
not preserved. A new Unix destination uses mode 0o666 filtered by the
process umask.
SELinux context (Unix): On SELinux-enforcing hosts, same-filesystem renames
preserve the source inode’s security context. When staging under a secure base
such as /tmp and renaming onto the destination, the written file may keep
the staging label rather than the destination directory’s file-creation
context, which can make it inaccessible to a confined consumer. Creating the
final inode under a hostile (shared/non-sticky) destination parent would
reintroduce path-swap races, so this residual is accepted: apply restorecon
or chcon after a successful write when a specific context is required.
This does not fsync the file or containing directory, so it is not a power-loss durability guarantee.
The graph is validated with
NirGraph::validate_structure first:
a graph with dangling edges would produce a file that upstream refuses to
load, so it is rejected here instead. Opt out with
WriteOptions::with_validation.
§Errors
As write_with.
§Examples
nir_rs::io::write("model.nir", &graph)?;