From a5c55e7afa6bb6e6888105f9b435a17ca23d0a9a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?= Date: Thu, 22 Oct 2026 12:32:06 +0200 Subject: [PATCH] Vendor hex_core v0.21.1 hex_core v0.21.1 skips a package file whose name resolves to the root of the tarball when it's a directory, instead of crashing with FunctionClauseError in :lists.seq/2 (https://github.com/hexpm/hex_core/pull/252). Since hex_core v0.20.0 was vendored, mix hex.build crashed this way when the package files included the project directory, such as files: ["."], because expand_paths lists the directory itself as ".". Add a test that builds a package with files: ["."]. --- src/mix_hex_advisory.erl | 2 +- src/mix_hex_api.erl | 2 +- src/mix_hex_api_auth.erl | 2 +- src/mix_hex_api_key.erl | 2 +- src/mix_hex_api_oauth.erl | 2 +- src/mix_hex_api_organization.erl | 2 +- src/mix_hex_api_organization_member.erl | 2 +- src/mix_hex_api_package.erl | 2 +- src/mix_hex_api_package_owner.erl | 2 +- src/mix_hex_api_release.erl | 2 +- src/mix_hex_api_short_url.erl | 2 +- src/mix_hex_api_user.erl | 2 +- src/mix_hex_cli_auth.erl | 2 +- src/mix_hex_core.erl | 2 +- src/mix_hex_core.hrl | 4 ++-- src/mix_hex_deflate.erl | 2 +- src/mix_hex_erl_tar.erl | 2 +- src/mix_hex_erl_tar.hrl | 2 +- src/mix_hex_http.erl | 2 +- src/mix_hex_http_httpc.erl | 2 +- src/mix_hex_licenses.erl | 2 +- src/mix_hex_oidc.erl | 2 +- src/mix_hex_pb_names.erl | 2 +- src/mix_hex_pb_package.erl | 2 +- src/mix_hex_pb_policy.erl | 2 +- src/mix_hex_pb_signed.erl | 2 +- src/mix_hex_pb_versions.erl | 2 +- src/mix_hex_registry.erl | 2 +- src/mix_hex_repo.erl | 2 +- src/mix_hex_safe_binary_to_term.erl | 2 +- src/mix_hex_tarball.erl | 14 +++++++++++--- src/mix_safe_erl_term.xrl | 2 +- test/mix/tasks/hex.build_test.exs | 20 ++++++++++++++++++++ test/support/release_samples.ex | 15 +++++++++++++++ 34 files changed, 78 insertions(+), 35 deletions(-) diff --git a/src/mix_hex_advisory.erl b/src/mix_hex_advisory.erl index 97954baa..f14acd36 100644 --- a/src/mix_hex_advisory.erl +++ b/src/mix_hex_advisory.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Display-time deduplication of security advisories. diff --git a/src/mix_hex_api.erl b/src/mix_hex_api.erl index 26dac828..9b84a940 100644 --- a/src/mix_hex_api.erl +++ b/src/mix_hex_api.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API diff --git a/src/mix_hex_api_auth.erl b/src/mix_hex_api_auth.erl index 49eb2b1a..2890d63e 100644 --- a/src/mix_hex_api_auth.erl +++ b/src/mix_hex_api_auth.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Authentication. diff --git a/src/mix_hex_api_key.erl b/src/mix_hex_api_key.erl index 222f5255..870ae11d 100644 --- a/src/mix_hex_api_key.erl +++ b/src/mix_hex_api_key.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Keys. diff --git a/src/mix_hex_api_oauth.erl b/src/mix_hex_api_oauth.erl index 5a30a3f1..15882345 100644 --- a/src/mix_hex_api_oauth.erl +++ b/src/mix_hex_api_oauth.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - OAuth. diff --git a/src/mix_hex_api_organization.erl b/src/mix_hex_api_organization.erl index 283f3781..97f918f1 100644 --- a/src/mix_hex_api_organization.erl +++ b/src/mix_hex_api_organization.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Organizations. diff --git a/src/mix_hex_api_organization_member.erl b/src/mix_hex_api_organization_member.erl index 03e1c087..73314f4c 100644 --- a/src/mix_hex_api_organization_member.erl +++ b/src/mix_hex_api_organization_member.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Organization Members. diff --git a/src/mix_hex_api_package.erl b/src/mix_hex_api_package.erl index cfcd8eac..190d8b15 100644 --- a/src/mix_hex_api_package.erl +++ b/src/mix_hex_api_package.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Packages. diff --git a/src/mix_hex_api_package_owner.erl b/src/mix_hex_api_package_owner.erl index 244345ae..80d064c0 100644 --- a/src/mix_hex_api_package_owner.erl +++ b/src/mix_hex_api_package_owner.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Package Owners. diff --git a/src/mix_hex_api_release.erl b/src/mix_hex_api_release.erl index d5c13df0..de60a24c 100644 --- a/src/mix_hex_api_release.erl +++ b/src/mix_hex_api_release.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Releases. diff --git a/src/mix_hex_api_short_url.erl b/src/mix_hex_api_short_url.erl index c4504e14..ae480ba6 100644 --- a/src/mix_hex_api_short_url.erl +++ b/src/mix_hex_api_short_url.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Short URLs. diff --git a/src/mix_hex_api_user.erl b/src/mix_hex_api_user.erl index a9c91dfd..a72d859b 100644 --- a/src/mix_hex_api_user.erl +++ b/src/mix_hex_api_user.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex HTTP API - Users. diff --git a/src/mix_hex_cli_auth.erl b/src/mix_hex_cli_auth.erl index ab2a3aba..28efd995 100644 --- a/src/mix_hex_cli_auth.erl +++ b/src/mix_hex_cli_auth.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Authentication handling with callback functions for build-tool-specific operations. diff --git a/src/mix_hex_core.erl b/src/mix_hex_core.erl index 9dbb958b..cce55c50 100644 --- a/src/mix_hex_core.erl +++ b/src/mix_hex_core.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% `hex_core' entrypoint module. diff --git a/src/mix_hex_core.hrl b/src/mix_hex_core.hrl index de97904d..23c06765 100644 --- a/src/mix_hex_core.hrl +++ b/src/mix_hex_core.hrl @@ -1,3 +1,3 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually --define(HEX_CORE_VERSION, "0.21.0"). +-define(HEX_CORE_VERSION, "0.21.1"). diff --git a/src/mix_hex_deflate.erl b/src/mix_hex_deflate.erl index 9dea5b71..031dfa8d 100644 --- a/src/mix_hex_deflate.erl +++ b/src/mix_hex_deflate.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Pure-Erlang raw DEFLATE (RFC 1951) encoder. The output only depends on the diff --git a/src/mix_hex_erl_tar.erl b/src/mix_hex_erl_tar.erl index d1b27cba..bd668bd1 100644 --- a/src/mix_hex_erl_tar.erl +++ b/src/mix_hex_erl_tar.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% This file is a copy of erl_tar.erl from OTP with the following modifications: %% 1. Module renamed from erl_tar to mix_hex_erl_tar diff --git a/src/mix_hex_erl_tar.hrl b/src/mix_hex_erl_tar.hrl index b445efac..529c3d4f 100644 --- a/src/mix_hex_erl_tar.hrl +++ b/src/mix_hex_erl_tar.hrl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% This file is a copy of erl_tar.hrl from OTP without modifications. %% diff --git a/src/mix_hex_http.erl b/src/mix_hex_http.erl index 04dd4080..f30b6a1d 100644 --- a/src/mix_hex_http.erl +++ b/src/mix_hex_http.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% HTTP contract. diff --git a/src/mix_hex_http_httpc.erl b/src/mix_hex_http_httpc.erl index d366d8b5..55998fff 100644 --- a/src/mix_hex_http_httpc.erl +++ b/src/mix_hex_http_httpc.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% httpc-based implementation of {@link mix_hex_http} contract. diff --git a/src/mix_hex_licenses.erl b/src/mix_hex_licenses.erl index 65d8c9b5..0b1712f2 100644 --- a/src/mix_hex_licenses.erl +++ b/src/mix_hex_licenses.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Hex Licenses. diff --git a/src/mix_hex_oidc.erl b/src/mix_hex_oidc.erl index f9e474c0..12908e4b 100644 --- a/src/mix_hex_oidc.erl +++ b/src/mix_hex_oidc.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% OIDC token issuance for CI providers, used by Workload Identity. diff --git a/src/mix_hex_pb_names.erl b/src/mix_hex_pb_names.erl index 19883be2..864afef7 100644 --- a/src/mix_hex_pb_names.erl +++ b/src/mix_hex_pb_names.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% -*- coding: utf-8 -*- %% % this file is @generated diff --git a/src/mix_hex_pb_package.erl b/src/mix_hex_pb_package.erl index 57c8da60..515aa3e3 100644 --- a/src/mix_hex_pb_package.erl +++ b/src/mix_hex_pb_package.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% -*- coding: utf-8 -*- %% % this file is @generated diff --git a/src/mix_hex_pb_policy.erl b/src/mix_hex_pb_policy.erl index 09de44bd..2bd2fe56 100644 --- a/src/mix_hex_pb_policy.erl +++ b/src/mix_hex_pb_policy.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% -*- coding: utf-8 -*- %% % this file is @generated diff --git a/src/mix_hex_pb_signed.erl b/src/mix_hex_pb_signed.erl index 67f8b2e9..ce14b173 100644 --- a/src/mix_hex_pb_signed.erl +++ b/src/mix_hex_pb_signed.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% -*- coding: utf-8 -*- %% % this file is @generated diff --git a/src/mix_hex_pb_versions.erl b/src/mix_hex_pb_versions.erl index 31c1c86c..7126481a 100644 --- a/src/mix_hex_pb_versions.erl +++ b/src/mix_hex_pb_versions.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% -*- coding: utf-8 -*- %% % this file is @generated diff --git a/src/mix_hex_registry.erl b/src/mix_hex_registry.erl index 81ab3f1b..f5f17cf2 100644 --- a/src/mix_hex_registry.erl +++ b/src/mix_hex_registry.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Functions for encoding and decoding Hex registries. diff --git a/src/mix_hex_repo.erl b/src/mix_hex_repo.erl index 9d9f5e2a..fac10967 100644 --- a/src/mix_hex_repo.erl +++ b/src/mix_hex_repo.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Repo API. diff --git a/src/mix_hex_safe_binary_to_term.erl b/src/mix_hex_safe_binary_to_term.erl index 446e5644..6b78bda1 100644 --- a/src/mix_hex_safe_binary_to_term.erl +++ b/src/mix_hex_safe_binary_to_term.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @hidden %% Safe deserialization of Erlang terms from binary. diff --git a/src/mix_hex_tarball.erl b/src/mix_hex_tarball.erl index d42aae5e..7e87da45 100644 --- a/src/mix_hex_tarball.erl +++ b/src/mix_hex_tarball.erl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %% @doc %% Functions for creating and unpacking Hex tarballs. @@ -1130,8 +1130,16 @@ validate_create_files([], _FilesRoot, Acc) -> {ok, lists:reverse(Acc)}; validate_create_files([File | Rest], FilesRoot, Acc) -> case validate_create_file(File, FilesRoot) of - {ok, ValidatedFile} -> validate_create_files(Rest, FilesRoot, [ValidatedFile | Acc]); - {error, _} = Error -> Error + {ok, {ArchiveName, Entry} = ValidatedFile} -> + %% The archive root always exists, so a directory named after it + %% isn't stored and other entries can't take its name + case {archive_path_parts(ArchiveName), Entry} of + {[], directory} -> validate_create_files(Rest, FilesRoot, Acc); + {[], _} -> {error, {tarball, {unsafe_path, ArchiveName}}}; + _ -> validate_create_files(Rest, FilesRoot, [ValidatedFile | Acc]) + end; + {error, _} = Error -> + Error end. validate_create_file({Filename, Source, Options}, FilesRoot) when is_map(Options) -> diff --git a/src/mix_safe_erl_term.xrl b/src/mix_safe_erl_term.xrl index 52682a44..717b2ed3 100644 --- a/src/mix_safe_erl_term.xrl +++ b/src/mix_safe_erl_term.xrl @@ -1,4 +1,4 @@ -%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually +%% Vendored from hex_core v0.21.1 (d366662), do not edit manually %%% Author : Robert Virding %%% Purpose : Token definitions for Erlang. diff --git a/test/mix/tasks/hex.build_test.exs b/test/mix/tasks/hex.build_test.exs index da96199c..182d9440 100644 --- a/test/mix/tasks/hex.build_test.exs +++ b/test/mix/tasks/hex.build_test.exs @@ -233,6 +233,26 @@ defmodule Mix.Tasks.Hex.BuildTest do purge([ReleaseExcludePatterns.MixProject]) end + test "create with the project directory in files" do + Process.put(:hex_test_app_name, :build_with_project_dir) + Mix.Project.push(ReleaseProjectDir.MixProject) + + in_tmp(fn -> + Hex.State.put(:cache_home, tmp_path()) + + File.write!("myfile.txt", "hello") + File.mkdir!("dir") + File.write!("dir/test.txt", "world") + + Mix.Tasks.Hex.Build.run([]) + + extract("build_with_project_dir-0.0.1.tar", "unzip") + assert extracted_files("unzip") == ["dir/test.txt", "myfile.txt"] + end) + after + purge([ReleaseProjectDir.MixProject]) + end + test "excludes junk files at any depth" do Process.put(:hex_test_app_name, :build_junk_files) Mix.Project.push(ReleaseDefaultFiles.MixProject) diff --git a/test/support/release_samples.ex b/test/support/release_samples.ex index d63a4484..0465a80d 100644 --- a/test/support/release_samples.ex +++ b/test/support/release_samples.ex @@ -209,6 +209,21 @@ defmodule ReleaseExcludePatterns.MixProject do end end +defmodule ReleaseProjectDir.MixProject do + def project do + [ + app: Process.get(:hex_test_app_name) || raise("missing app name"), + version: "0.0.1", + description: "foo", + package: [ + files: ["."], + licenses: ["MIT"], + links: %{"a" => "http://a"} + ] + ] + end +end + defmodule ReleaseEscapingFiles.MixProject do def project do [