From 3a47e14cbe6e15de0758c8bd4233a8d84ff80aa8 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 05:12:40 +0000
Subject: Reject archive outputs inside rootfs

---
 src/archive.rs   | 19 +++++++++++++++++++
 tests/archive.rs | 17 +++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/src/archive.rs b/src/archive.rs
index 9a899bf..ad424c4 100644
--- a/src/archive.rs
+++ b/src/archive.rs
@@ -26,6 +26,7 @@ impl NativeTarWriter {
         }
 
         let output = output.as_ref();
+        reject_output_inside_rootfs(rootfs, output)?;
         let temporary = temporary_output_path(output)?;
         let result = (|| {
             let file = OpenOptions::new()
@@ -53,6 +54,24 @@ impl NativeTarWriter {
     }
 }
 
+fn reject_output_inside_rootfs(rootfs: &Path, output: &Path) -> Result<()> {
+    let rootfs = rootfs
+        .canonicalize()
+        .with_context(|| format!("canonicalize rootfs {}", rootfs.display()))?;
+    let output_parent = output.parent().unwrap_or_else(|| Path::new("."));
+    let output_parent = output_parent
+        .canonicalize()
+        .with_context(|| format!("canonicalize archive output parent {}", output_parent.display()))?;
+    if output_parent.starts_with(&rootfs) {
+        bail!(
+            "archive output must not be inside rootfs: {} is below {}",
+            output.display(),
+            rootfs.display()
+        );
+    }
+    Ok(())
+}
+
 fn temporary_output_path(output: &Path) -> Result<PathBuf> {
     let name = output
         .file_name()
diff --git a/tests/archive.rs b/tests/archive.rs
index da3e66a..6f803ef 100644
--- a/tests/archive.rs
+++ b/tests/archive.rs
@@ -107,6 +107,23 @@ fn rejects_a_missing_rootfs() {
     assert!(error.to_string().contains("rootfs is not a directory"));
 }
 
+#[test]
+fn rejects_an_archive_output_inside_the_rootfs() {
+    let fixture = tempdir().expect("fixture directory");
+    let rootfs = fixture.path().join("rootfs");
+    fs::create_dir_all(rootfs.join("etc")).expect("create rootfs");
+    fs::write(rootfs.join("etc/controller.conf"), "controller=true\n").expect("write rootfs file");
+    let artifact = rootfs.join("controller.tar");
+
+    let error = NativeTarWriter::new()
+        .write(&rootfs, &artifact)
+        .expect_err("archive output inside rootfs must be rejected");
+
+    assert!(error.to_string().contains("archive output must not be inside rootfs"));
+    assert!(!artifact.exists());
+    assert!(!rootfs.join("controller.tar.partial").exists());
+}
+
 #[test]
 fn removes_partial_output_when_an_unsupported_entry_stops_packaging() {
     let fixture = tempdir().expect("fixture directory");
-- 
cgit v1.2.3