[lczyk]

• Have you signed the CLA?

---

did some formal verification (fizzbee, my specs are here and here) of the cut path and found 7 minor bugs:

• fix: prefer ignores x-arch paths #330
• fix: validation miss for mutable: true, until: mutate #331
• fix: implicit parents hiding explicit paths #332
• fix: manifest attribution of until: mutate #333
• fix: hard links against content from another package #334
• fix: hard links whose target is not in the manifest #335 (this PR)
• fix: listed mode of copied paths #336

test-package ships /file and /hardlink-to-file. cut the following slice:

# slices/test-package.yaml
package: test-package
slices:
  myslice:
    contents:
      /file: {until: mutate}
      /hardlink-to-file:

$ chisel cut --release ./ --arch amd64 --root $rootfs test-package_myslice
Extracting files from package "test-package"...
error: cannot extract from package "test-package": cannot add hard link /hardlink-to-file to report: target /file not previously added

the release validates but does not cut. same with the target covered by a glob with until: mutate.

repro using chisel-proxy, with a prebuilt deb (its directory packing does not keep hard links):

$ alias chisel-proxy='go run github.com/lczyk/chisel-proxy/cmd/chisel-proxy@v0.3.0'
$ chisel-proxy cut --arch amd64 ./test-package_0.0.0_amd64.deb ./test-package.yaml \
    -- --root ./rootfs test-package_myslice
Extracting files from package "test-package"...
error: cannot extract from package "test-package": cannot add hard link /hardlink-to-file to report: target /file not previously added

fix

builds on #334: with the extraction on main a hard link can still be made against another package's file, and this fallback would then record that content. merge #334 first.

paths with until: mutate are kept out of the manifest, so the link's target is never there. hard link entries now carry the hash and size of their content (fsutil.Create hashes it from disk), and a link whose target is not in the report is recorded as a regular file with that content. links whose target is reported keep sharing an inode as before.

[Copilot]

🟡 Changes recommended

Address the hard-link symlink handling and add the missing hash/size test coverage.

1 open finding

• Avoid following symlinks when hashing hard links · New

What changed in this PR

Fixes extraction and manifest reporting for hard links whose targets are omitted by until: mutate.

Changes:

• Hashes hard-link content and records standalone metadata.
• Handles unreported hard-link targets.
• Adds manifest and slicer regression coverage.

File	Summary
internal/​slicer/​slicer_test.go	Adds end-to-end hard-link coverage.
internal/​manifestutil/​report.go	Handles omitted targets; symlink metadata must be preserved.
internal/​manifestutil/​report_test.go	Tests standalone hard-link reporting.
internal/​fsutil/​create.go	Adds hard-link hashing; hashing must avoid incorrectly following symlinks, with additional assertions needed.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate issues remain in hard-link ownership, symlink handling, and permission-sensitive extraction.

1 open finding

• Hard links may incorrectly reference content from another package · New

1 resolved since last review

• Avoid following symlinks when hashing hard links

Previously missed (1)

In code that hasn't changed since last review

Fallback converts unreported symlink hard links into empty regular files

internal/​manifestutil/​report.go:80

This fallback misreports hard links to symlinks when the symlink target is omitted from the report (for example, until: mutate). fsutil.Create intentionally returns regular mode with an empty hash for that case, so clearing Link makes the manifest describe the actual symlink inode as an empty regular file. Preserve the symlink type/target or reject this unsupported case instead of converting every unreported hard link to a regular file.

🧠 Review effort: Lite