Function write_within 

pub fn write_within(
    target: &Utf8Path,
    destination: &Utf8Path,
    bytes: &[u8],
) -> Result<()>

Write a repository-relative destination under a target, refusing a path that leaves it.

check_destination runs first, so a symlinked parent directory is refused before a byte lands, and the write itself is write_atomic.

Errors

A std::io::ErrorKind::PermissionDenied error naming the refusal when the destination cannot be touched, and any I/O error of the write.