From 4b3418a8a771edd87f85d3770fc7fd4e6fc05c09 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Tue, 11 Aug 2026 21:08:42 +0000
Subject: Archive independent rootfs with required privileges

---
 README.md   |  2 +-
 src/main.rs | 40 ++++++++++++++++++++++------------------
 2 files changed, 23 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index 4cd3b96..9b8e9b6 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ An independent Rust proof of concept that produces an ALT Controller rootfs tarb
 2. The profile uses vendored package lists under `profiles/package-lists/`.
 3. Rust initializes an isolated Hasher work root with `hsh --initroot-only`.
 4. Rust installs the resolved package set with `hsh-install`.
-5. Rust archives `work/alt-controller/chroot` to `out/alt-controller-rootfs.tar` using `tar`, excluding Hasher's `.host` helper directory.
+5. Rust invokes `sudo tar` to archive `work/alt-controller/chroot` to `out/alt-controller-rootfs.tar`, excluding Hasher's `.host` helper directory. Root is needed only to read root-owned/setuid paths produced inside the isolated Hasher root.
 
 Hasher is intentionally the only external build dependency in this slice. It supplies ALT package resolution and isolation; the image/profile orchestration belongs to this project.
 
diff --git a/src/main.rs b/src/main.rs
index 44cb296..9e081a8 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -18,31 +18,35 @@ fn main() {
     let rootfs = workdir.join("chroot");
     let artifact = artifact_path(&project);
 
-    if workdir.exists() {
-        fs::remove_dir_all(&workdir).expect("remove previous Hasher workdir");
+    let archive_existing = env::args().any(|argument| argument == "--archive-existing");
+    if !archive_existing {
+        if workdir.exists() {
+            fs::remove_dir_all(&workdir).expect("remove previous Hasher workdir");
+        }
+        fs::create_dir_all(&workdir).expect("create Hasher workdir");
+        run(
+            Command::new("hsh")
+                .args(["--mountpoints=/proc", "--initroot-only", "--workdir"])
+                .arg(&workdir),
+            "initialize isolated Hasher root",
+        );
+
+        let mut install = Command::new("hsh-install");
+        install.args(["--mountpoints=/proc", "--workdir"]);
+        install.arg(&workdir);
+        install.args(profile.install_arguments());
+        run(&mut install, "install target rootfs packages");
     }
-    fs::create_dir_all(&workdir).expect("create Hasher workdir");
+    assert!(rootfs.is_dir(), "isolated rootfs is missing: {}", rootfs.display());
     fs::create_dir_all(artifact.parent().expect("artifact parent")).expect("create output directory");
 
-    run(
-        Command::new("hsh")
-            .args(["--mountpoints=/proc", "--initroot-only", "--workdir"])
-            .arg(&workdir),
-        "initialize isolated Hasher root",
-    );
-
-    let mut install = Command::new("hsh-install");
-    install.args(["--mountpoints=/proc", "--workdir"]);
-    install.arg(&workdir);
-    install.args(profile.install_arguments());
-    run(&mut install, "install target rootfs packages");
-
     if artifact.exists() {
         fs::remove_file(&artifact).expect("remove previous artifact");
     }
     run(
-        Command::new("tar")
-            .args(["--numeric-owner", "--xattrs", "--acls", "--exclude=./.host", "-C"])
+        Command::new("sudo")
+            .arg("tar")
+            .args(["--numeric-owner", "--exclude=./.host", "-C"])
             .arg(&rootfs)
             .args(["-cpf"])
             .arg(&artifact)
-- 
cgit v1.2.3