archive.Extract creates every directory with fileperms.PublicDir rather than using the permission mode from the tar header. CreateDeterministicArchive later derives new headers from those extracted filesystem modes.
As a result, an extract/repack cycle can silently change unrelated explicit directory permissions—for example, 0700, 0555, or 0775 become 0755—even when an overlay modifies only a file.
This behavior was introduced with archive utility PR #223. PRs #275/#276 make the existing extract/repack path part of source preparation.
Expected behavior
- Preserve permission bits from explicit directory headers.
- Apply restrictive directory modes after children are materialized if necessary.
- Continue using
PublicDir for synthetic parent directories that had no archive header.
- Define and test the policy for special mode bits separately.
- Add round-trip tests for representative modes such as 0700, 0555, and 0775.
A streaming archive transformer is not required.
archive.Extractcreates every directory withfileperms.PublicDirrather than using the permission mode from the tar header.CreateDeterministicArchivelater derives new headers from those extracted filesystem modes.As a result, an extract/repack cycle can silently change unrelated explicit directory permissions—for example, 0700, 0555, or 0775 become 0755—even when an overlay modifies only a file.
This behavior was introduced with archive utility PR #223. PRs #275/#276 make the existing extract/repack path part of source preparation.
Expected behavior
PublicDirfor synthetic parent directories that had no archive header.A streaming archive transformer is not required.