On 2026-04-07 at 19:24:54, Jeff King wrote: > Yes, but note that with "-P" tar will happily allow those paths. They > _can_ be useful, if you know what you are doing, but they aren't > necessarily safe when coming from untrusted sources. > > We can also generate zip files, but I think most unzip implementations > have similar restrictions (info-zip does, with "-:" to override). I suspect there are people using this with `/` because they want to deploy files to places like `/etc`. We've actually had requests for the ability to have multiple roots in a repository so that people can do this kind of thing, so I'm certain there are people finding _some_ way to do it, even if not with this exact approach. In conjunction with a tool like mtree(1) to adjust ownership and permissions, this could be useful. > In theory we could support other formats, but after 20 years I don't > think anybody has bothered to do so. Cpio, anyone? :) cpio doesn't have the long filename support that our pax (tar) archives have, so I wouldn't recommend adding it. The only place I still see people use it is initramfs images for Linux. > I don't recall it ever being discussed. Of the three you mentioned, > "../" and leading "/" are potentially useful, so I don't think we'd want > to disallow them entirely. At least some tar implementations require > "-P" on the generating side to avoid mistakes, so we could follow that > path. It may be considered a regression by anybody who is using the > feature currently, though. > > The "////" is meaningless AFAICT, and could be replaced with a single > slash. But I think it's also mostly harmless, as the reading side (well, > the kernel) will equate "foo/////file" and "foo/file". I don't know if > there are systems where that would not be the case. Technically, POSIX allows `//` to be different than `/`, I believe, although I'm not aware of anyone outside of Windows (and maybe Interix) where that has any special meaning. If you have such a system, it could be useful to provide that as well as `/`. I agree that it's more likely a typo, though. -- brian m. carlson (they/them) Toronto, Ontario, CA