Repository navigation
Skip tarball root directory entries instead of crashing - #252
Merged
Merged
Conversation
hex_tarball:create/3 and hex_tarball:create_docs/2 crashed with a function_clause error in lists:seq/2 when a file name resolved to the root of the tarball, such as ".", "./" or "a/..". Since #228 directories with files under them are dropped by computing each name's parent directories, and a name with no path components called lists:seq(1, -1). rebar3_hex passes {".", DocDir} for the docs directory itself, so its docs builds fail with hex_core v0.20.0 and later. A directory named after the root is now skipped, which gives the same tarball as v0.19.0 for a non-empty directory. A regular file or symlink with such a name returns an unsafe_path error. v0.19.0 wrote it as a member named ".", which failed to unpack to disk with eisdir. Fixes #251
ericmj
force-pushed
the
ericmj/tarball-root-entries
branch
from
October 22, 2026 09:26
71e0b60 to
bb03c53
Compare
This was referenced Oct 22, 2026
Merged
ericmj
added a commit
to hexpm/hex
that referenced
this pull request
Oct 22, 2026
hex_core v0.21.1 skips a package file whose name resolves to the root of the tarball when it's a directory, instead of crashing with FunctionClauseError in :lists.seq/2 (hexpm/hex_core#252). Since hex_core v0.20.0 was vendored, mix hex.build crashed this way when the package files included the project directory, such as files: ["."], because expand_paths lists the directory itself as ".". Add a test that builds a package with files: ["."].
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
hex_tarball:create/3andhex_tarball:create_docs/2crash with afunction_clauseerror inlists:seq(1, -1)when a file name resolves to the root of the tarball, such as".","./"or"a/..". Since #228, directories with files under them are dropped by computing each name's parent directories, and a name with no path components breaks that computation. rebar3_hex passes{".", DocDir}for the docs directory itself, so its docs builds fail with hex_core v0.20.0 and later (erlef/rebar3_hex#387 filters the entry out as a workaround).A directory named after the root is now skipped, which gives the same tarball as v0.19.0 for a non-empty directory. A regular file or symlink with such a name returns
{error, {tarball, {unsafe_path, Name}}}. v0.19.0 wrote it as a member named., which failed to unpack to disk witheisdir.Fixes #251