From 18601639d6c09cf0cfe5954a1dc85726ef5bd479 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Fri, 21 Aug 2026 19:31:00 -0700 Subject: [PATCH] fix(packages): expose public output to clients --- internal/cli/package_repository.go | 7 ++++++- internal/cli/package_repository_test.go | 9 +++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/internal/cli/package_repository.go b/internal/cli/package_repository.go index ab6bee3..f83be1b 100644 --- a/internal/cli/package_repository.go +++ b/internal/cli/package_repository.go @@ -363,12 +363,17 @@ func newScratchRoots() (scratchRoots, error) { return scratchRoots{}, fmt.Errorf("create package repository scratch: %w", err) } roots := scratchRoots{parent: parent} - for _, name := range []string{"source", "work", "output"} { + for _, name := range []string{"source", "work"} { if mkdirErr := os.Mkdir(filepath.Join(parent, name), 0o750); mkdirErr != nil { _ = roots.Close() return scratchRoots{}, fmt.Errorf("create package repository %s root: %w", name, mkdirErr) } } + // #nosec G301 -- package-manager helpers must traverse the read-only bind mount. + if mkdirErr := os.Mkdir(filepath.Join(parent, "output"), 0o755); mkdirErr != nil { + _ = roots.Close() + return scratchRoots{}, fmt.Errorf("create package repository output root: %w", mkdirErr) + } roots.source, err = os.OpenRoot(filepath.Join(parent, "source")) if err != nil { _ = roots.Close() diff --git a/internal/cli/package_repository_test.go b/internal/cli/package_repository_test.go index cc64b5b..5e1a6b2 100644 --- a/internal/cli/package_repository_test.go +++ b/internal/cli/package_repository_test.go @@ -63,6 +63,15 @@ func TestPackageRepositoryCommandPublishesResolvedRequest(t *testing.T) { require.NotNil(t, input.Source) require.NotNil(t, input.Work) require.NotNil(t, input.Output) + sourceInfo, sourceStatErr := os.Stat(input.Source.Name()) + require.NoError(t, sourceStatErr) + assert.Equal(t, os.FileMode(0o750), sourceInfo.Mode().Perm()) + workInfo, workStatErr := os.Stat(input.Work.Name()) + require.NoError(t, workStatErr) + assert.Equal(t, os.FileMode(0o750), workInfo.Mode().Perm()) + outputInfo, outputStatErr := os.Stat(input.Output.Name()) + require.NoError(t, outputStatErr) + assert.Equal(t, os.FileMode(0o755), outputInfo.Mode().Perm()) scratchPaths = []string{input.Source.Name(), input.Work.Name(), input.Output.Name()} return pkgrepo.PublishResult{