@nebulon here's what an AI found:
Tarball Permissions
The tarball contains files with ownership/permissions the process can’t replicate (e.g., root-owned files).
Example: Extraction fails when tar.extract preserves original ownership.
SELinux/AppArmor
Security policies block filesystem operations despite correct permissions.
Tar Library Behavior:
The tar library (likely tar-fs) might try to preserve file permissions from the tarball. If the tarball contains files owned by root and the app runs as yellowtent, extraction fails unless permissions are ignored.
Fix: Modify the code to ignore permissions:
javascript
const tarStream = tar.extract({ cwd: destinationPath, ignore: () => true });
Debugging Steps
Check Permissions:
javascript
console.log('Source:', fs.statSync(sourcePath).mode.toString(8));
console.log('Dest:', fs.statSync(destinationPath).mode.toString(8));
Ensure Directory Exists:
javascript
if (!fs.existsSync(destinationPath)) fs.mkdirSync(destinationPath, { recursive: true });
fs.accessSync(destinationPath, fs.constants.W_OK);
Add Error Logging:
javascript
const readStream = fs.createReadStream(sourcePath).on('error', (err) => console.error('Read:', err));
const unzipStream = zlib.createGunzip().on('error', (err) => console.error('Gunzip:', err));
const tarStream = tar.extract({ cwd: destinationPath }).on('error', (err) => console.error('Tar:', err));
Potential Fixes
Ignore Tar Permissions:
javascript
const tarStream = tar.extract({ cwd: destinationPath, ignore: () => true });
Test with Logging: Run the modified code with error handlers.
async function tarExtract(sourcePath, destinationPath) {
ensureSafePath(sourcePath);
ensureSafePath(destinationPath);
console.log('Source:', sourcePath, fs.statSync(sourcePath));
console.log('Dest:', destinationPath, fs.existsSync(destinationPath) ? fs.statSync(destinationPath) : 'does not exist');
const readStream = fs.createReadStream(sourcePath)
.on('error', (err) => console.error('Read error:', err));
const unzipStream = zlib.createGunzip()
.on('error', (err) => console.error('Gunzip error:', err));
const tarStream = tar.extract({ cwd: destinationPath })
.on('error', (err) => console.error('Tar error:', err));
readStream.pipe(unzipStream).pipe(tarStream);
await streamPromise(tarStream);
}
Conclusion
The error is likely a mismatch between the Cloudron app’s user permissions and the filesystem.
