alexcrichton / tar-rs

Tar file reading/writing for Rust
https://docs.rs/tar
Apache License 2.0
625 stars 184 forks source link

`Header::set_path` normalization seems to make the crate unsuitable for Debian packaging #335

Open vrmiguel opened 1 year ago

vrmiguel commented 1 year ago

Hey @alexcrichton! To preface, great job on this crate :D

Context: Debian packages (.deb) are Unix archives (.ar) that must contain two .tar.{gz, xz} files.

For instance, one .deb's data.tar.gz file might look something something like

$ dpkg-deb  -c ~/stremio_4.4.160-1_amd64.deb

drwxr-xr-x root/root         0 2023-06-01 12:07 ./
drwxr-xr-x root/root         0 2023-06-01 12:07 ./opt/
drwxr-xr-x root/root         0 2023-06-01 12:07 ./opt/stremio/
drwxr-xr-x root/root         0 2023-06-01 12:07 ./opt/stremio/icons/
-rw-r--r-- root/root      1795 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio-tray_128.png
-rw-r--r-- root/root       225 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio-tray_16.png
-rw-r--r-- root/root       278 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio-tray_22.png
-rw-r--r-- root/root       293 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio-tray_24.png
-rw-r--r-- root/root       371 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio-tray_32.png
-rw-r--r-- root/root       752 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio-tray_64.png
-rw-r--r-- root/root      2843 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio_128.png
-rw-r--r-- root/root       428 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio_16.png
-rw-r--r-- root/root       504 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio_22.png
-rw-r--r-- root/root       547 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio_24.png
-rw-r--r-- root/root       689 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio_32.png
-rw-r--r-- root/root      1391 2023-06-01 12:07 ./opt/stremio/icons/smartcode-stremio_64.png
-rw-r--r-- root/root   4846217 2023-06-01 12:07 ./opt/stremio/server.js
-rw-r--r-- root/root       391 2023-06-01 12:07 ./opt/stremio/smartcode-stremio.desktop
-rwxr-xr-x root/root    272760 2023-06-01 12:07 ./opt/stremio/stremio
lrwxrwxrwx root/root         0 2023-06-01 12:07 ./opt/stremio/node -> /usr/bin/node

Since tars must always be absolute, using ./ is a workaround to allow referring to something in the root folder

If one tried to accomplish this with the tar crate right now, the resulting archive would be

drwxr-xr-x root/root         0 2023-07-29 15:58 ./
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/postgresql/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/postgresql/15/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/postgresql/15/lib/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/postgresql/15/lib/bitcode/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/postgresql/15/lib/bitcode/vector/
drwxr-xr-x root/root         0 2023-07-29 15:58 usr/lib/postgresql/15/lib/bitcode/vector/src/
-rw-r--r-- root/root     20460 2023-07-29 15:58 usr/lib/postgresql/15/lib/bitcode/vector/src/ivfbuild.bc

We do get ./ in there because of special treatment here, but it's eliminated in the rest, resulting in an incorrect Debian package.

I found no workaround to this behavior in the crate, so I had to vendor it and modify the check done in copy_path_into.

Related to #263

vrmiguel commented 1 year ago

I find that @mfrischknecht suggestion in #263 would work well here

https://github.com/alexcrichton/tar-rs/issues/263#issuecomment-905279517

However, the path normalization could be considered part of the current crate API and therefore changing that would be a breaking change.

My suggestion is a new, non-default, feature flag, e.g. dont-normalize, that alters this check. With this flag people who don't care about the normalization still get the same behavior for the crate but anyone otherwise in need of the ./ prefix could still opt into it

If @alexcrichton agrees, I could open the PR that does this