fix(delivery): resolve verified library aliases inside guest inputs

2026-10-12 15:31:35 +08:00
parent 41c3334568
commit 4b02cb2c84
2 changed files with 30 additions and 2 deletions
@@ -107,8 +107,15 @@ def curated(root: Path, records: dict, name: str, target: Path) -> None:
        if not current.is_symlink() or os.readlink(current) != entry["link"]:
            raise DeliveryError("runtime input link differs")
        if entry["link"].startswith("/"):
-            raise DeliveryError("absolute runtime input link refused")
-        current = Path(os.path.normpath(current.parent / entry["link"]))
+            # Public Arch libraries may contain /usr/lib aliases. Interpret
+            # them within the fingerprinted guest tree, never the build host.
+            if not relative.startswith("services/usr/lib/") or not entry["link"].startswith(
+                "/usr/lib/"
+            ):
+                raise DeliveryError("absolute runtime input link refused")
+            current = Path(os.path.normpath(root / "services" / entry["link"].lstrip("/")))
+        else:
+            current = Path(os.path.normpath(current.parent / entry["link"]))
        if not current.is_relative_to(root):
            raise DeliveryError("runtime input escapes trusted root")
    raise DeliveryError("runtime input link depth limit")