fix: restrict access to unsanitized intermediate rootfs archives

2026-10-13 04:53:33 +03:00
parent 36a91a2451
commit 52c1db7ef0
2 changed files with 8 additions and 1 deletions
@@ -413,6 +413,10 @@ fi'''
        source_inputs = image.source_identity(self.source_dir)
        self.record('rootfs', complete=False)
        original = self.work / 'artifacts/builder-rootfs.tar'
+        if original.is_symlink() or not original.parent.resolve().is_relative_to(self.work):
+            raise BuildError('Raw export output must remain inside the dedicated work directory')
+        original.touch(mode=0o600, exist_ok=True)
+        original.chmod(0o600)  # The unsanitized intermediate can contain builder-private trust.
        self.pod('export', '--output', str(original), self.name)
        snapshot = image.digest(original)
        assembler = self.assembly(snapshot)