Skip to content

🐛 Change Mkdir to MkdirAll when extracting tarball#5039

Open
juanis2112 wants to merge 3 commits into
ossf:mainfrom
juanis2112:fix-tarball
Open

🐛 Change Mkdir to MkdirAll when extracting tarball#5039
juanis2112 wants to merge 3 commits into
ossf:mainfrom
juanis2112:fix-tarball

Conversation

@juanis2112
Copy link
Copy Markdown
Contributor

What kind of change does this PR introduce?

Bug fix: This PR changes Mkdir to MkdirAll when extracting tarball to avoid errors when tarballs contain file entries that share a parent directory.

What is the current behavior?

When running Scorecard against certain repositories, the tool exits early with an internal error due to a mkdir: file exists error during tarball extraction. This causes the repository to be skipped entirely.

What is the new behavior (if this is a feature change)?

If tarballs contain file entries that share a parent directory, the is no error returned.

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #5023

Does this PR introduce a user-facing change?

NONE

@juanis2112 juanis2112 requested a review from a team as a code owner April 27, 2026 22:44
@juanis2112 juanis2112 requested review from AdamKorcz and spencerschrock and removed request for a team April 27, 2026 22:44
@dosubot dosubot Bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Apr 27, 2026
dependabot Bot and others added 2 commits April 27, 2026 15:46
Bumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.3 to 2.0.6.
- [Release notes](https://github.com/sigstore/timestamp-authority/releases)
- [Changelog](https://github.com/sigstore/timestamp-authority/blob/main/CHANGELOG.md)
- [Commits](sigstore/timestamp-authority@v2.0.3...v2.0.6)

---
updated-dependencies:
- dependency-name: github.com/sigstore/timestamp-authority/v2
  dependency-version: 2.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: juanis2112 <[email protected]>
@dosubot dosubot Bot removed the size:S This PR changes 10-29 lines, ignoring generated files. label Apr 27, 2026
@dosubot dosubot Bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Apr 27, 2026
@dosubot dosubot Bot added size:S This PR changes 10-29 lines, ignoring generated files. and removed size:L This PR changes 100-499 lines, ignoring generated files. labels Apr 27, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 27, 2026

Codecov Report

❌ Patch coverage is 0% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.25%. Comparing base (353ed60) to head (1507d9c).
⚠️ Report is 359 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #5039      +/-   ##
==========================================
+ Coverage   66.80%   68.25%   +1.45%     
==========================================
  Files         230      252      +22     
  Lines       16602    15734     -868     
==========================================
- Hits        11091    10740     -351     
+ Misses       4808     4136     -672     
- Partials      703      858     +155     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 8, 2026

This pull request has been marked stale because it has been open for 10 days with no activity

@github-actions github-actions Bot added Stale and removed Stale labels May 8, 2026
@github-actions
Copy link
Copy Markdown

This pull request has been marked stale because it has been open for 10 days with no activity

@github-actions github-actions Bot added Stale and removed Stale labels May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BUG: tarball extraction fails with "file exists" error when archive contains duplicate directory entries

1 participant