pub fn read_declared_artifact_checked(
bundle_dir: &Path,
artifact_dir: &str,
relative: &str,
max_bytes: u64,
) -> Option<String>Expand description
Read a remotely requested artifact only when both its declared path and canonical target stay under the artifact directory named by the manifest.