Repository navigation
Conversation
Failure: the checksum-pinned Fabric archive contains a repository-only .claude/skills symlink that Python 3.10's safe tar filter resolves outside the extraction destination, so the qualified native ARM64 image build stops before compiling any source. Decision: retain tarfile.data_filter for every build input while excluding only that unused repository metadata symlink; do not disable traversal checks or alter the pinned archive. Validation: focused regression test passes; the isolated Brev ARM64 build is the live acceptance check.
Failure: Python 3.10's backported data filter resolves every relative Fabric archive link from the extraction root instead of the member directory, so required in-tree LICENSE links still fail after excluding repository metadata. Decision: normalize symlink targets using tar semantics, require them to remain inside the archive's single top-level root, retain tar_filter path and mode checks, and clear archive ownership metadata. Validation: focused tests accept member-relative in-tree links and reject traversal outside the archive root; isolated ARM64 image build follows.
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
CI disposition for |
|
Superseded by 6141179, which replaced the host-side image/fabric/build.py runner with Docker Bake and shared Docker build stages. The current build verifies the pinned archive checksum and extracts it with tar inside Docker, so the Python 3.10 tarfile code path fixed here no longer exists. The replacement image builds passed on Linux ARM64. Closing without merging; no compatibility helper or helper-specific regression test needs carrying forward. |
wscurran
added
area: packaging
Outcome
The pinned Fabric source archive now extracts on Python 3.10. Safe in-tree symbolic links remain intact, and links that escape the archive root are rejected.
Reason
Python 3.10 resolves archive link targets differently from newer
tarfile.data_filterbehavior. The pinned Fabric archive contains an in-tree metadata link that blocked the isolated ARM64 image build used for VoiceClaw R0 qualification.Related issues
Refs #11752
Changes
Verification
python3 -m unittest test_build.RecipeCoverage.test_safe_archive_links_use_member_relative_resolution— passed.Signed-off-by: Julie Yaunches jyaunches@nvidia.com