Pack archive artifacts in mesh-build-go, a module's directory or a pinned file, and refuse any path that leads out of the module through a link (issue 1589, ADR 0478 §1) #408

Merged

mesh-tools merged 11 commits from fix/1589-archive-artifacts into main 2026-10-21 10:34:00 +00:00

Conversation 4 Commits 11 Files Changed 13

+741 -10

11 Commits

Author	SHA1	Message	Date
mesh-tools	e023f69989	Compare an archive's tar stream with the build agent's always and its digest only under the Go it was captured with (issue 1589)	2026-10-21 09:52:22 +00:00
mesh-tools	ef154705b9	Make an archive's digest independent of the umask of the account that packs it (issue 1589)	2026-10-21 09:49:13 +00:00
mesh-tools	d7e6074d97	Refuse a build output directory that is a link out of the module (issue 1589)	2026-10-21 09:46:47 +00:00
mesh-tools	800d6624d5	Refuse an archive of a module directory that is a link out of the workspace's tree (issue 1589)	2026-10-21 09:45:58 +00:00
mesh-tools	6993ef003c	Refuse an archive whose directory leads out of the module through a symlinked parent (review of issue 1589)	2026-10-21 09:19:03 +00:00
mesh-tools	406ee69732	Add the pinned release the archive tests serve (issue 1589)	2026-10-21 09:13:40 +00:00
mesh-tools	8bfa626a8b	Test archive artifacts against build-agent's own digests (issue 1589)	2026-10-21 09:13:32 +00:00
mesh-tools	bfd6b7c7ce	Say the build tool packs archives, give the module a client for pinned files, and record how the digests were captured (issue 1589)	2026-10-21 09:12:55 +00:00
mesh-tools	640c6f9b0c	Hand an archive artifact to the packing step (issue 1589, ADR 0478 §1)	2026-10-21 09:12:23 +00:00
mesh-tools	d369adf245	Unpack and pack archive artifacts in mesh-build-go: a module's directory or a pinned file (issue 1589, ADR 0478 §1)	2026-10-21 09:11:29 +00:00
mesh-tools	d8f87808b5	Add the archive fixture tree for mesh-build-go's archive tests (issue 1589)	2026-10-21 09:10:41 +00:00