Tarbomb in release src tarball file #8685

New Issue

GiteaMirror · 2025-11-02T08:14:28-06:00

GiteaMirror commented

2025-11-02 08:14:28 -06:00

Originally created by @eleksir on GitHub (Mar 12, 2022).

Gitea Version

1.16.3

Git Version

N/A

Operating System

N/A

How are you running Gitea?

tar xf gitea-src-1.16.3.tar.gz

Database

No response

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

N/A

Description

Gitea official src, gitea-src-1.16.3.tar.gz, (from releases page at github, particulary at release of 1.16.3) contains tarbomb. Such behavior is considered bad etiquette on the part of the archive's creator.

Expected behavior is (after untarring) to find this pile of files in subdir named gitea-src-1.16.3 or even better in subdir named gitea-1.16.3.

Screenshots

N/A

Originally created by @eleksir on GitHub (Mar 12, 2022). ### Gitea Version 1.16.3 ### Git Version N/A ### Operating System N/A ### How are you running Gitea? tar xf gitea-src-1.16.3.tar.gz ### Database _No response_ ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist N/A ### Description Gitea official src, gitea-src-1.16.3.tar.gz, (from releases page at [github](https://github.com/go-gitea/gitea/releases), particulary at [release of 1.16.3](https://github.com/go-gitea/gitea/releases/tag/v1.16.3)) contains [tarbomb](https://en.wikipedia.org/wiki/Tar_(computing)#Tarbomb). Such behavior is considered bad etiquette on the part of the archive's creator. Expected behavior is (after untarring) to find this pile of files in subdir named gitea-src-1.16.3 or even better in subdir named gitea-1.16.3. ### Screenshots N/A

GiteaMirror added the hacktoberfest topic/distribution issue/confirmed good first issue labels 2025-11-02 08:14:28 -06:00

GiteaMirror closed this issue

2025-11-02 08:14:28 -06:00

GiteaMirror commented

2025-11-02 08:14:29 -06:00

@wULLSnpAXbWZGYDYyhWTKKspEQoaYxXyhoisqHf commented on GitHub (Mar 12, 2022):

fair point, IMO, this shouldn't be hard to fix.
what I usually tend to do anyway is automaticaly create a folder for pretty much any archive I am untarring, then use tar with -C newfolder. those times I forget to prepare a folder hurt, though.

@wULLSnpAXbWZGYDYyhWTKKspEQoaYxXyhoisqHf commented on GitHub (Mar 12, 2022): fair point, IMO, this shouldn't be hard to fix. what I usually tend to do anyway is automaticaly create a folder for pretty much any archive I am untarring, then use tar with `-C newfolder`. those times I forget to prepare a folder hurt, though.

GiteaMirror commented

2025-11-02 08:14:29 -06:00

@lunny commented on GitHub (Mar 14, 2022):

That's generated by Github I think, maybe you should submit an issue to them?

@lunny commented on GitHub (Mar 14, 2022): That's generated by Github I think, maybe you should submit an issue to them?

GiteaMirror commented

2025-11-02 08:14:29 -06:00

@eleksir commented on GitHub (Mar 15, 2022):

https://github.com/twpayne/chezmoi/issues/1576

absolutely same thing but it was resolved without Github intervention.

@eleksir commented on GitHub (Mar 15, 2022): https://github.com/twpayne/chezmoi/issues/1576 absolutely same thing but it was resolved without Github intervention.

GiteaMirror commented

2025-11-02 08:14:29 -06:00

@techknowlogick commented on GitHub (Mar 15, 2022):

gitea-src-1.16.3.tar.gz (and similar) is a custom tar that we create in the make-release step of CI, so it would need to be updated in our CI.

@techknowlogick commented on GitHub (Mar 15, 2022): `gitea-src-1.16.3.tar.gz` (and similar) is a custom tar that we create in the make-release step of CI, so it would need to be updated in our CI.

GiteaMirror commented

2025-11-02 08:14:30 -06:00

@zeripath commented on GitHub (Mar 16, 2022):

We'd need to use --transform or --xform option in the tar within the release-sources target in the Makefile here:

ed1d95c55d/Makefile (L648)

@eleksir would you like to test and propose a PR?

documentation for the tar command and the --transform option can be found here:

https://www.gnu.org/software/tar/manual/html_section/transform.html

@zeripath commented on GitHub (Mar 16, 2022): We'd need to use `--transform` or `--xform` option in the `tar` within the `release-sources` target in the `Makefile` here: https://github.com/go-gitea/gitea/blob/ed1d95c55dfa91d1c9a486bfb8e00375d4038e29/Makefile#L648 @eleksir would you like to test and propose a PR? --- documentation for the tar command and the `--transform` option can be found here: https://www.gnu.org/software/tar/manual/html_section/transform.html

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#8685