From 227ee2af958eba340d5d7b269387455b4513277d Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 06:39:37 +0000
Subject: Reject ambiguous archive members in comparison

---
 tests/compare.rs | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

(limited to 'tests')

diff --git a/tests/compare.rs b/tests/compare.rs
index 4f48721..ab63f9a 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -370,6 +370,30 @@ fn normalizes_legacy_dot_prefixed_archive_paths_before_comparison() {
     assert!(compare(&manifest, &expected).is_equivalent());
 }
 
+#[test]
+fn rejects_duplicate_archive_member_paths_before_semantic_comparison() {
+    let fixture = tempdir().expect("temporary directory");
+    let artifact = fixture.path().join("ambiguous-legacy.tar");
+    let file = fs::File::create(&artifact).expect("create legacy archive");
+    let mut archive = tar::Builder::new(file);
+
+    for contents in [b"first\n".as_slice(), b"second\n".as_slice()] {
+        let mut header = tar::Header::new_gnu();
+        header.set_size(contents.len() as u64);
+        header.set_mode(0o644);
+        header.set_cksum();
+        archive
+            .append_data(&mut header, "./etc/controller.conf", Cursor::new(contents))
+            .expect("append duplicate legacy member");
+    }
+    archive.finish().expect("finish legacy archive");
+
+    let error = ArtifactManifest::collect_archive(&artifact)
+        .expect_err("ambiguous archive paths cannot be compared semantically");
+
+    assert!(error.to_string().contains("duplicate archive member record: etc/controller.conf"));
+}
+
 #[test]
 fn collects_hardlink_targets_from_an_archive_for_semantic_comparison() {
     let fixture = tempdir().expect("temporary directory");
-- 
cgit v1.2.3