[lczyk]

• Have you signed the CLA?

---

did some formal verification (fizzbee, my specs are here and here) of the cut path and found 7 minor bugs:

• fix: prefer ignores x-arch paths #330
• fix: validation miss for mutable: true, until: mutate #331 (this PR)
• fix: implicit parents hiding explicit paths #332
• fix: manifest attribution of until: mutate #333
• fix: hard links against content from another package #334
• fix: hard links whose target is not in the manifest #335
• fix: listed mode of copied paths #336

# slices/test-package.yaml
package: test-package
slices:
  myslice:
    contents:
      /dir/text-file: {text: data1, mutable: true, until: mutate}
    mutate: content.write("/dir/text-file", "data2")

$ chisel info --release ./ test-package_myslice
package: test-package
slices:
  myslice:
    contents:
      /dir/text-file: {text: data1, mutable: true, until: mutate}
    mutate: content.write("/dir/text-file", "data2")
$ chisel cut --release ./ --arch amd64 --root $rootfs test-package_myslice
Extracting files from package "test-package"...
error: slice test-package_myslice: cannot mutate path in report: /dir/text-file not previously added

the release validates fine but does not cut.

repro using chisel-proxy (which does not reimplement any of the chisel logic, so definitely not a proxy bug)

$ alias chisel-proxy='go run github.com/lczyk/chisel-proxy/cmd/chisel-proxy@v0.3.0'
$ mkdir -p test-package/usr/share/doc/test-package
$ echo readme > test-package/usr/share/doc/test-package/README
$ chisel-proxy info ./test-package.yaml -- test-package_myslice
package: test-package
slices:
    myslice:
        contents:
            /dir/text-file: {text: data1, mutable: true, until: mutate}
        mutate: |
            content.write("/dir/text-file", "data2")
$ chisel-proxy cut --arch amd64 ./test-package ./test-package.yaml \
    -- --root ./rootfs test-package_myslice
Extracting files from package "test-package"...
error: slice test-package_myslice: cannot mutate path in report: /dir/text-file not previously added

fix

a path that is removed after mutate has no business being mutable. the combination is now rejected at validation time.

mutable: true, until: mutate does not appear in any of the ubuntu branches on chisel-reelases:

$ for b in $(git branch -r --list 'origin/ubuntu-*'); do
    echo "$b"
    files=$(git ls-tree -r --name-only "$b" -- slices)
    for f in $files; do
        git show "$b:$f" | yq '
          .slices[].contents // {}
            | to_entries[]
            | select(.value.mutable and .value.until == "mutate")
            | .key'
    done
done

[Copilot]

🟢 Approval recommended

No unresolved review issues remain.

0 open findings

What changed in this PR

Adds release validation to reject mutable: true combined with until: mutate, preventing a cut-time failure.

Changes:

• Rejects the incompatible path options.
• Adds regression coverage for the validation error.

File	Summary
internal/​setup/​yaml.go	Validates incompatible path options.
internal/​setup/​setup_test.go	Tests the new validation rule.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[upils]

@lczyk This is an interesting one because I don't think it is obvious that this case must be invalid.
I think we could have situation were we extract a path foo, mutate it, use the result to mutate another path bar and then get rid of foo. I am thinking about inter-script communication. But I will need to check if we want to allow that or not.

[lczyk]

I don't think it is obvious that this case must be invalid.

yeah, i've thought about this afterwards, but decided ultimately to go with this because it's easier to allow smth in the future rather than then disallow it (regression). also we're not doing anything like this atm so disllowing it wouldn't hurt. kindof like the "if in doubt, don't include it" principle for making slices