Expand description
Materializing a sysroot from a rootfs archive.
No privileges are needed: ownership is not restored, and setuid and
setgid bits are dropped, since the bundle never needs either. Such a
file also gains owner read, because a mode like ---s--x--- leaves
the packer unable to read the sysroot it just wrote. Every
entry path is checked before the entry is written, so an archive cannot
reach outside the directory it is unpacked into.
The archive is unpacked into a sibling directory that takes the target’s name only once every entry is in place. A refused or broken archive leaves nothing at the target, so a later build never mistakes a truncated rootfs for a materialized one.
Directory permissions are applied last. A rootfs holds directories a distribution made read-only, and giving one its archived mode as soon as it appears locks out every entry underneath it that has not been written yet.
Functions§
- materialize
- Unpack the
.taror.tar.zstarchive atarchiveintointo, which must not exist yet or be empty.