# Incorrect permissions on event_writer.py in splunk-sdk 1.7.2 fail AppInspect

Vendoring splunk-sdk 1.7.2 into a Splunk app fails AppInspect because one file in the SDK ships with wrong permissions: lib/splunklib/modularinput/event_writer.py is 755 (rwxr-xr-x) while every other file in the package is 644. AppInspect rejects the executable bit on a Python module. Fixed upstream by normalizing the file permissions in the repo.

## How to handle it

This was fixed in the SDK itself. Upgrade to splunk-sdk 1.7.3 or newer, where event_writer.py ships with the correct 644 permissions like the rest of the package. The fix came in via a community PR that the Splunk maintainers merged, and the maintainer confirmed on the thread that the corrected permissions are in the 1.7.3 release. If you vendor the SDK, re-copy the directory from 1.7.3+ so the bad permission doesnt come along.

Source: https://github.com/splunk/splunk-sdk-python/issues/487