skip to content

detached 9783786

docs(executor): say that archive links are validated at install time

commit: 978378657d0e9253c67988518d5a850dffeef345
author: brice · 8d ago · 2026-10-14 03:14 UTC
parent: e509bea
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +3 -0

M internal/executor/actions_extract.go +3 -0


@@ -60,6 +60,9 @@ func (c *capReader) Read(p []byte) (int, error) {
60	60		// no link whose target leaves dir, and everything is written through an
61	61		// os.Root, so that a link planted by an earlier entry cannot redirect a later
62	62		// one. The decompressed stream is capped, and ctx is checked between entries.
	63	+	// Links are validated at install time: a running step can change the action
	64	+	// tree like any file of its own sandbox, so this is not a confinement guarantee
	65	+	// for what happens later.
63	66		// owner, when set, is the uid and gid of the files.
64	67		func extractTarball(ctx context.Context, r io.Reader, dir string, owner *[2]int) error {
65	68		zr, err := gzip.NewReader(r)


@@ -60,6 +60,9 @@ func (c *capReader) Read(p []byte) (int, error) {
60		// no link whose target leaves dir, and everything is written through an	60		// no link whose target leaves dir, and everything is written through an
61		// os.Root, so that a link planted by an earlier entry cannot redirect a later	61		// os.Root, so that a link planted by an earlier entry cannot redirect a later
62		// one. The decompressed stream is capped, and ctx is checked between entries.	62		// one. The decompressed stream is capped, and ctx is checked between entries.
			63	+	// Links are validated at install time: a running step can change the action
			64	+	// tree like any file of its own sandbox, so this is not a confinement guarantee
			65	+	// for what happens later.
63		// owner, when set, is the uid and gid of the files.	66		// owner, when set, is the uid and gid of the files.
64		func extractTarball(ctx context.Context, r io.Reader, dir string, owner *[2]int) error {	67		func extractTarball(ctx context.Context, r io.Reader, dir string, owner *[2]int) error {
65		zr, err := gzip.NewReader(r)	68		zr, err := gzip.NewReader(r)