Repository navigation
fix(archive): opens route through Root — the reported bypass and the hidden one - #345
Merged
Merged
Conversation
…hidden one Issue #225: openArchive used os.Open, bypassing fsroot.Root confinement — and the zip branch hid a second bypass, closing the file to re-open it by path via zip.OpenReader (its own unconfined os.Open). Opens now route through root.Open(root.NewPath(source)) (the file provider's idiom); newZipArchiveReader takes the already-open handle (Stat for size, zip.NewReader, handle owned and closed by the reader), so the zip branch hands the confined handle over and the spool path drops a close-and-reopen. The sweep of all remaining os-level file I/O in providers found four judgment groups (spool scratch, plan documents, starlark sources, git subprocess trees) — ruled deliberate keeps, each site now carrying a one-line confinement-reason comment. Plan: docs/plans/archive-root-confinement.md.
David-Noble-at-work
added a commit
that referenced
this pull request
Aug 9, 2026
…Rs (#355) A plan committed inside its own PR predates the merge by construction, so no completed plan recorded where it landed. Each of the five now ends with the PR it landed as and the squash date: implicit-common-project and git-crypt-pinning (#354), writ-repo-remote (#353), writ-repo-command (#352), archive-root-confinement (#345). Co-authored-by: David Noble <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #225.
openArchivebypassedfsroot.Rootwithos.Open— and the zip branch hid a second bypass, re-opening by path throughzip.OpenReader. Opens now route throughroot.Open(root.NewPath(source));newZipArchiveReadertakes the open handle (Stat+zip.NewReader, handle owned by the reader), so zip reads the confined handle and the spool path drops a close-and-reopen. The broadened sweep of all provider os-level file I/O found four judgment groups — none a hole of this kind — ruled deliberate keeps, each site annotated with a one-line confinement reason (docs/plans/archive-root-confinement.md). Verified: suite green, board zero both GOOS, zeroos.Openleft in the archive provider.