Exclude nested internal metadata from manifests

2 files changed, 27 insertions, 2 deletions

diff --git a/src/manifest.rs b/src/manifest.rs
index ed326e1..307913e 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -157,7 +157,7 @@ fn collect_files(rootfs: &Path) -> Result<Vec<FileRecord>> {
     for entry in WalkDir::new(rootfs).follow_links(false).min_depth(1) {
         let entry = entry.with_context(|| format!("walk rootfs {}", rootfs.display()))?;
         let relative = entry.path().strip_prefix(rootfs).expect("walk entry is below rootfs");
-        if relative.components().next().is_some_and(|part| part.as_os_str() == ".host" || part.as_os_str() == ".fakedata") {
+        if is_internal_metadata_path(&portable_path(relative)?) {
             continue;
         }
         let path = portable_path(relative)?;
@@ -301,7 +301,7 @@ fn is_enabled_service(path: &str) -> bool {
 }
 
 fn is_internal_metadata_path(path: &str) -> bool {
-    matches!(path.split('/').next(), Some(".host" | ".fakedata"))
+    path.split('/').any(|component| matches!(component, ".host" | ".fakedata"))
 }
 
 fn is_archive_root_path(path: &str) -> bool {
diff --git a/tests/compare.rs b/tests/compare.rs
index 2dfd46d..7dd44e2 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -328,6 +328,31 @@ fn native_manifest_collection_excludes_internal_members_from_its_archive_facts()
 }
 
 #[test]
+fn archive_collection_excludes_nested_internal_metadata_members() {
+    let fixture = tempdir().expect("temporary directory");
+    let rootfs = fixture.path().join("rootfs");
+    fs::create_dir_all(rootfs.join("var/.fakedata")).expect("create fakeroot metadata");
+    fs::create_dir_all(rootfs.join("etc")).expect("create visible directory");
+    fs::write(rootfs.join("var/.fakedata/owner"), "metadata").expect("write fakeroot metadata");
+    fs::write(rootfs.join("etc/controller.conf"), "controller\n").expect("write visible file");
+    let artifact = fixture.path().join("legacy.tar");
+    let mut writer = tar::Builder::new(fs::File::create(&artifact).expect("create legacy archive"));
+    writer.append_dir_all(".", &rootfs).expect("write legacy archive");
+    writer.finish().expect("finish legacy archive");
+
+    let manifest = ArtifactManifest::collect_archive(&artifact).expect("collect archive facts");
+
+    assert!(manifest
+        .archive_members
+        .iter()
+        .all(|record| !record.path.split('/').any(|component| component == ".fakedata")));
+    assert!(manifest
+        .files
+        .iter()
+        .all(|record| !record.path.split('/').any(|component| component == ".fakedata")));
+}
+
+#[test]
 fn rootfs_collection_recognizes_services_enabled_by_non_default_targets() {
     let fixture = tempdir().expect("temporary directory");
     let rootfs = fixture.path().join("rootfs");