WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-10-21 15:31:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateguard): extract the arm tree without handing tar a drive letter

Browse Source 
materializeTree passed the archive as an absolute path. GNU tar, which Git for
Windows bundles and puts first on PATH in Git Bash, reads an -f argument
containing a colon as a host:path remote spec and fails with "Cannot connect to
C: resolve failed". bsdtar, the tar in system32 that PowerShell resolves, has no
remote-spec parsing, so the fault only appeared under a bash-based shell - and
there it failed a committed test, not just a dry run.

Name the archive relatively and run tar with dest as its cwd, which extracts
identically under both tars and makes -C unnecessary. git archive keeps the
absolute -o path, which git handles on Windows.

Two tests, because the environment-dependent kind of fault needs both: one
injects a spawn and asserts no tar argument is absolute or drive-lettered, which
holds the invariant on any platform; the other prepends Git's bundled GNU tar to
PATH and extracts into a drive-letter destination, so the original failure is
reproducible from PowerShell too, where it was previously invisible.
This commit is contained in:
montjeffrey
2026-10-04 22:40:42 -04:00
parent e716f7ea65
commit bfd4f8255a
2 changed files with 67 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/gateguard-effectiveness/arms.js
+13 -7
View File
@@ -45,8 +45,8 @@ function run(rawInput) {
module.exports = { run };
`;
function git(repoRoot, args) {
const result = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8', shell: false, timeout: 60000 });
function git(repoRoot, args, spawn = spawnSync) {
const result = spawn('git', ['-C', repoRoot, ...args], { encoding: 'utf8', shell: false, timeout: 60000 });
if (result.status !== 0 || result.error) throw new Error(`git ${args[0]} failed: ${String(result.stderr || result.error).trim()}`);
return result.stdout;
}
@@ -57,12 +57,18 @@ function resolveRef(repoRoot, ref) {
}
/** Extracts scripts/ at a commit into dest and adds the arm wrapper; returns dest. */
function materializeTree(repoRoot, sha, dest) {
function materializeTree(repoRoot, sha, dest, spawn = spawnSync) {
fs.mkdirSync(dest, { recursive: true });
const tar = path.join(dest, 'scripts.tar');
git(repoRoot, ['archive', '--format=tar', '-o', tar, sha, 'scripts']);
const extract = spawnSync('tar', ['-xf', tar, '-C', dest], { encoding: 'utf8', shell: false, timeout: 60000 });
fs.rmSync(tar, { force: true });
const tarName = 'scripts.tar';
git(repoRoot, ['archive', '--format=tar', '-o', path.join(dest, tarName), sha, 'scripts'], spawn);
// Name the archive relatively and run tar with dest as cwd, so no argument carries a
// "C:\..." drive letter. GNU tar (Git Bash / MSYS on Windows) reads an archive argument
// containing a colon as a "host:path" remote spec and dies with "Cannot connect to C:
// resolve failed"; bsdtar (C:\Windows\system32\tar.exe) does not, which is why the
// absolute path only broke under GNU tar. A relative -f plus cwd extracts identically
// under both and makes -C unnecessary.
const extract = spawn('tar', ['-xf', tarName], { cwd: dest, encoding: 'utf8', shell: false, timeout: 60000 });
fs.rmSync(path.join(dest, tarName), { force: true });
if (extract.status !== 0 || extract.error) throw new Error(`tar failed: ${String(extract.stderr || extract.error).trim()}`);
fs.copyFileSync(path.join(__dirname, 'arm-patch.js'), path.join(dest, 'arm-patch.js'));
fs.writeFileSync(path.join(dest, ...ARM_HOOK.split('/')), WRAPPER);