Zoltan Kochan
68445b254a
Verify configuration dependency registry resolutions before installing plugins, with independently checked pinned tarballs. Require config dependencies to resolve from a registry and skip registry verification when the installed config dependencies already match the lockfile. Constrain archive and deployment paths and preserve content-addressed files when streaming package entries. Bound metadata allocation before the archive parser buffers it, using an opt-in patch to the upstream tar crate. Bound publishing manifest and README buffers without imposing a total extraction disk quota. Bind audit signatures to lockfile integrity, hash ambiguous URL dependency directory names, and sanitize license terminal output. Preserve dependency error context and structured fatal logs. Update affected documentation, release notes, and regression coverage.
661 B
661 B
Local tar metadata bound
Source: crates.io tar 0.4.46, repository https://github.com/composefs/tar-rs.
Upstream revision: fc459c149f83bf4daceaa52e17d351989002e1a9.
The original MIT and Apache-2.0 licenses are retained.
Upstream GitHub workflow and dependency-update configuration is omitted.
This patch adds Archive::set_max_metadata_size(Option<u64>). Raw and logical entry
iteration check GNU long-name, GNU long-link, and PAX payload sizes
before buffering them. GNU sparse extension chains share the same byte bound. The default remains unrestricted for compatibility.
Remove this local patch when upstream provides an equivalent metadata bound.