Repository navigation
fix(fallback): skip links and specials when repacking a tag archive - #459
Merged
Merged
Conversation
`zed pack` walks the working tree and takes regular files only, so a link or special file in the source tree is simply absent from the published artifact. The tag-archive repack instead failed closed on the first such entry, which made any repository that merely carries a symlink unresolvable from github.com while the registry origin is down. flags-2-env/flags-2-env v0.3.0 is the live case: its tree contains `clients/bun/publish.sh` as a symlink, so installing it from GitHub failed with "unsupported type Symlink" even though publishing that same tag omits the link entirely. Skipping matches publish exactly, which is what keeps a repacked tag byte-identical to the published artifact. Path traversal, size and entry count limits are unchanged, and the store still verifies the digest. cargo test --locked --lib: 619 passed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #379 / #458. A repository that merely carries a symlink was unresolvable from github.com while the registry origin is down.
zed packwalks the working tree and takes regular files only, so links and specials never appear in a published artifact. The tag-archive repack instead failed closed on the first such entry:flags-2-env/flags-2-envv0.3.0 is a live dependency ofORESoftware/ores-compose, and publishing that same tag omits the link entirely — so refusing it made the repack disagree with publish, which is exactly what the repack exists to reproduce.Change
Skip non-regular entries instead of failing. That matches publish, and it is what keeps a repacked tag byte-identical to the published artifact. Path-traversal rejection, the size cap and the entry-count cap are unchanged, and the store still verifies the digest against the pin.
The test that asserted the old behaviour is rewritten to assert the new one: a fixture carrying a symlink repacks successfully, and the link is absent from the result.
Evidence
cargo test --locked --lib: 619 passed.zed packon the flags-2-env v0.3.0 tag tree: 360 files, 143 excluded by publish rules, sha256b4e88e4f…— the digest a repack must reproduce.http://127.0.0.1:9: the ores-compose graph now gets past flags-2-env. The remaining failure is a genuine repository defect elsewhere in that graph (ORESoftware/ores-interfacesdeclares a target rooted atgenerated/public, which.gitignoreexcludes, sozed packfails there too — tracked separately).🤖 Generated with Claude Code