[[!comment format=mdwn
 username="joey"
 subject="""comment 6"""
 date="2018-09-05T18:26:33Z"
 content="""
Reproduced.

Analysis: In v6, `git annex add` runs `git ls-files --modified`, 
which runs the clean filter on the unlocked file as git sees it was
modified. Which in ingests the file with lockingFile = False.
So, the annex object doesn't get the write bit cleared at that point.
Then when `git annex add` gets around to ingesting the file
itself, since the annex object is already present it's used as-is.

`git add` of a new file in v6 also puts content in the annex
with the write bit set. If a different file with that same content is then passed
to `git annex add`, the same thing happens with the symlink to unprotected
content.

So, linkToAnnex should freezeContent. That would solve all cases that lead
to this. (But not when annex.thin has made the annex object a hard link,
in that case it being writable is expected.)
"""]]
