vhaudiquet 1fb3f0c076 fix(extract): modes degrade instead of killing the unpack ...

With preservation on, the crate chmods every file to the mode it
ships as it extracts, and one refused bit killed the whole run:
alpine's usr/bin/chage ships setgid-shadow (02755, group shadow),
and an extracting context that cannot set the bit - an overlayfs
tmp, a confined sandbox - fails the chmod with EPERM and takes the
boot down with "failed to set permissions to 2755".

The crate's own chmod now runs with the special bits masked off,
which no filesystem refuses, and the shipped modes ride the fixups
like directory modes already do: applied after the walk, degraded
to plain rwx when the filesystem refuses them, exact everywhere
else. Unprivileged tar degrades the same way; the guest re-applies
whatever it needs. The setgid regression test pins the round trip.

2026-10-28 15:30:30 +01:00

..

ecrou

fix(extract): modes degrade instead of killing the unpack

2026-10-28 15:30:30 +01:00

ecrou-cli

feat(vm): capture the payload's output into a host directory

2026-10-28 13:37:33 +01:00