[lczyk]

• Have you signed the CLA?

---

did some formal verification (fizzbee, my specs are here and here) of the cut path and found 7 minor bugs:

• fix: prefer ignores x-arch paths #330
• fix: validation miss for mutable: true, until: mutate #331
• fix: implicit parents hiding explicit paths #332
• fix: manifest attribution of until: mutate #333
• fix: hard links against content from another package #334 (this PR)
• fix: hard links whose target is not in the manifest #335
• fix: listed mode of copied paths #336

test-package1 ships /file and /hardlink, a hard link to it. test-package2 ships its own /file. cut the following slices:

# slices/test-package1.yaml
package: test-package1
slices:
  myslice:
    essential:
      test-package2_myslice:
    contents:
      /hardlink:

# slices/test-package2.yaml
package: test-package2
slices:
  myslice:
    contents:
      /file:

$ chisel cut --release ./ --arch amd64 --root $rootfs test-package1_myslice test-package2_myslice
Extracting files from package "test-package2"...
Extracting files from package "test-package1"...
$ cat $rootfs/hardlink
bar
$ stat -c '%i' $rootfs/file $rootfs/hardlink
214420890
214420890

/hardlink carries test-package2's content and shares its inode. test-package2 is extracted first (the essential), so its /file is on disk when test-package1's link entry is reached, and the link is made against it. with the packages the other way round the link is a copy of test-package1's own content.

repro using chisel-proxy, with two prebuilt debs (its directory packing does not keep hard links):

$ alias chisel-proxy='go run github.com/lczyk/chisel-proxy/cmd/chisel-proxy@v0.3.0'
$ chisel-proxy cut --arch amd64 ./test-package1_0.0.0_amd64.deb ./test-package2_0.0.0_amd64.deb ./test-package1.yaml ./test-package2.yaml \
    -- --root ./rootfs test-package1_myslice test-package2_myslice
Extracting files from package "test-package2"...
Extracting files from package "test-package1"...
$ cat ./rootfs/hardlink
bar

with the fix cat prints foo and the inodes differ.

fix

a hard link is only created in the first pass when its target was extracted by the same package in the same pass. otherwise the entry goes through the existing second pass, which writes the package's own content. a deferred link to a link waits for the content at the end of the chain, a deferred link to a symlink becomes that symlink, and link targets may be spelled with or without the leading ./.

[Copilot]

🟡 Changes recommended

The tracking excludes same-package symlinks and earlier hard links, breaking those valid link targets.

1 open finding

• Track same-package symlinks and hard links as extraction targets · New

What changed in this PR

This PR fixes Chisel’s package extraction so a hard link cannot pick up content from a previously extracted package.

Changes:

• Track regular files extracted by the current package before creating a hard link.
• Add a slice test for packages that provide the same target path.

File	Description
internal/​tarball/​extract.go	Restricts first-pass hard links to tracked package content.
internal/​slicer/​slicer_test.go	Tests the cross-package hard-link case.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Deferred link chains can produce empty files, and valid relative link targets can now be rejected.

0 open findings

1 resolved since last review

• Track same-package symlinks and hard links as extraction targets

Previously missed (2)

In code that hasn't changed since last review

Resolve deferred hard-link chains to content-bearing entries

internal/​tarball/​extract.go:240

When a selected hard link points to another hard-link entry that this package did not extract, deferring it here does not recover its content. For example, package A contains ./file (foo), ./a (link to ./file), and ./b (link to ./a); select only /b while another package already provides /a. This change correctly avoids linking /b to that other package, but the second pass reads A's ./a header, which has no payload, and writes an empty /b instead of foo. Resolve deferred link chains back to their content-bearing entry before writing the selected link.

Normalize hard-link targets before validating extracted paths

internal/​tarball/​extract.go:244

This now validates every selected hard-link target with sanitizeTarPath, which accepts only names starting with ./. A valid tar entry can have Name: "./hardlink" and Linkname: "file"; if this package already extracted ./file, the previous code could link to it, but this change returns invalid link target file instead. Normalize safe relative link names to the same path format as tar members before checking extracted, while still rejecting targets outside the root.

🧠 Review effort: Lite