Bounded verification and staging extraction of one Manifest v1 NIF bundle.
This internal boundary takes an artifact's string-keyed metadata. The caller
remains responsible for complete manifest validation and target resolution.
extract/4 creates a new absolute staging directory below existing real
directories; it refuses symlink components and pre-existing destinations.
It neither installs/promotes files nor accesses a network or compiler.
Only strict USTAR regular files and necessary parent directories are accepted. Gzip framing uses two bounded public-OTP inflation passes, including a size-minus-one prefix check to reject ignored suffixes or additional members. The complete tar spool is verified before any payload file is extracted.
Summary
Functions
Finite default resource limits for local archive verification.
Verifies a local .tar.gz and extracts its exact files into a new staging path.
Functions
Finite default resource limits for local archive verification.
@spec extract(binary(), map(), binary(), keyword()) :: {:ok, map()} | {:error, NativeArtifact.Error.t()}
Verifies a local .tar.gz and extracts its exact files into a new staging path.
Returns directory, sorted relative files, entrypoint and pinned archive digest.
Positive integer options are the keys returned by default_limits/0.
Defaults cap compressed bytes at 256 MiB, payload at 1 GiB, tar overhead at
16 MiB, files at 4096, headers at 8192, directories at 4096 and work at 180 s.
Limits apply before writes; each inflation pass checks its output/deadline.
Failure removes only the staging tree created by this invocation.