fix race puting a Link ahead of its target File

This avoids a situation in the async Pack class where a detected Link
and File pair can end up with the Link ahead of the File in the archive,
meaning that it'll throw an error when it tries to unpack, because the
hardlink target will not exist yet.

Fix: #448

Author: isaacs

CHANGELOG.md

@@ -7,6 +7,8 @@
 - Only read from ustar block if not specified in Pax
 - Fix sync tar.list when file size reduces while reading
 - Sanitize absolute linkpaths properly
+- Prevent writing hardlink entries to the archive ahead of their
+  file target
 
 ## 7.4
 

src/pack.ts

@@ -70,6 +70,7 @@ export class Pack
   extends Minipass<Buffer, ReadEntry | string, WarnEvent<Buffer>>
   implements Warner
 {
+  sync: boolean = false
   opt: TarOptions
   cwd: string
   maxReadSize?: number
@@ -286,6 +287,18 @@ export class Pack
     // now we have the stat, we can filter it.
     if (!this.filter(job.path, stat)) {
       job.ignore = true
+    } else if (
+      stat.isFile() &&
+      stat.nlink > 1 &&
+      job === this[CURRENT] &&
+      !this.linkCache.get(`${stat.dev}:${stat.ino}`) &&
+      !this.sync
+    ) {
+      // if it's not filtered, and it's a new File entry,
+      // jump the queue in case any pending Link entries are about
+      // to try to link to it. This prevents a hardlink from coming ahead
+      // of its target in the archive.
+      this[PROCESSJOB](job)
     }
 
     this[PROCESS]()

test/create.ts

@@ -167,7 +167,6 @@ t.test('create', t => {
   const p = c(['README.md'])
   //@ts-expect-error
   p.then
-  //@ts-expect-error
   p.sync
   t.type(c(['README.md']), Pack)
 

test/pack.js

@@ -1,7 +1,7 @@
 import t from 'tap'
 import { Pack, PackSync } from '../dist/esm/pack.js'
 import fs from 'fs'
-import path from 'path'
+import path, { resolve } from 'path'
 import { fileURLToPath } from 'url'
 
 import { Header } from '../dist/esm/header.js'
@@ -92,9 +92,10 @@ t.test('pack a file', t => {
         throw new Error('no data!')
       }
 
+      t.equal(sync.subarray(512).length, data.subarray(512).length)
       t.equal(
-        sync.subarray(512).toString(),
-        data.subarray(512).toString(),
+        (sync.subarray(512).toString()),
+        (data.subarray(512).toString()),
       )
       const hs = new Header(sync)
       t.match(hs, expect)
@@ -1816,14 +1817,22 @@ t.test('prefix and subdirs', t => {
 
 // https://github.com/npm/node-tar/issues/284
 t.test('prefix and hard links', t => {
-  const dir = path.resolve(fixtures, 'pack-prefix-hardlinks')
-  t.teardown(_ => rimraf.sync(dir))
-  mkdirp.sync(dir + '/in/z/b/c')
-  fs.writeFileSync(dir + '/in/target', 'ddd')
-  fs.linkSync(dir + '/in/target', dir + '/in/z/b/c/d')
-  fs.linkSync(dir + '/in/target', dir + '/in/z/b/d')
-  fs.linkSync(dir + '/in/target', dir + '/in/z/d')
-  fs.linkSync(dir + '/in/target', dir + '/in/y')
+  const target = resolve(t.testdirName, 'in', 'target')
+  const dir = t.testdir({
+    in: {
+      target: 'ddd',
+      z: {
+        b: {
+          c: {
+            d: t.fixture('link', target),
+          },
+          d: t.fixture('link', target),
+        },
+        d: t.fixture('link', target),
+      },
+      y: t.fixture('link', target),
+    },
+  })
 
   const expect = [
     'out/x/\0',
@@ -1901,14 +1910,14 @@ t.test('prefix and hard links', t => {
     p.end()
   }
 
-  t.test('async', t => {
+  t.test('async', async t => {
     t.test('.', t => runTest(t, '.', Pack))
-    return t.test('./', t => runTest(t, './', Pack))
+    t.test('./', t => runTest(t, './', Pack))
   })
 
-  t.test('sync', t => {
+  t.test('sync', async t => {
     t.test('.', t => runTest(t, '.', PackSync))
-    return t.test('./', t => runTest(t, './', PackSync))
+    t.test('./', t => runTest(t, './', PackSync))
   })
 
   t.end()