Warn on outward relative path sources
Metadata
Current evaluation
Warn when parsed part sources are absolute or resolve above Path.cwd(), since managed builds can misread paths or copy the root; triaged and still open.
Suggested action: keep open
Reason: The report provides a concrete ../../../ example and explains that it resolves to / in LXD, potentially causing a local-source copy of the entire root and disk-space errors. The issue is explicitly labeled Status: Triaged, a maintainer clarified that absolute paths should also warn, and no resolving implementation was found in the inspected source or history.
Evaluated by: mr-cal-bot
Impact:
58
Quick Win:
27
Complexity:
42
Confidence:
90
Actionability:
80
Issue body
### What needs to get done
A warning should be raised when a part with a source above `Path.cwd()` is parsed. This works in destructive mode, but it will almost always fail in managed builds.
### Why it needs to get done
Currently, supplying a relative path for a `source:` isn't supported and can very easily lead to unexpected behavior. Consider the following project structure:
```
├── misc
│ └── packaging
│ └── snap
│ └── snapcraft.yaml
└── src
└── main.c
```
And a part with the following:
```yaml
parts:
plugin: [any]
source: ../../../
source-type: [git or local]
```
Once this gets into a LXD build environment, `../../../` will always resolve to `/`. Then, depending on the file-type, you can get behaviors ranging from "not a git directory" (from `source-type: git`) to disk space errors due to it attempting to copy _the entire root_ (from `source-type: local`).
Since this _could_ be a desired behavior, but is almost certainly not, a warning should be issued in this case.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
27
Complexity:
42
Confidence:
90
Actionability:
80
|
keep open | Warn when parsed part sources are absolute or resolve above Path.cwd(), since managed builds can misread paths or copy the root; triaged and still open. | |
| stealth/space-bunny-alpha |
Impact:
40
Quick Win:
19
Complexity:
40
Confidence:
72
Actionability:
78
|
keep open | Maintainer-filed, triaged request to warn when a part's source: path is relative and resolves above Path.cwd() (or absolute), since it silently becomes '/' in LXD builds. lengau expanded scope to absolute paths. No fix yet. | |
| stealth/space-bunny-alpha |
Impact:
62
Quick Win:
37
Complexity:
28
Confidence:
94
Actionability:
84
|
keep open | Add parsing warnings for local or Git source paths that are absolute or resolve above the current working directory, preventing managed builds from unexpectedly reaching the root filesystem. | |
| qwen/qwen3.6-35b-a3b |
Impact:
70
Quick Win:
39
Complexity:
30
Confidence:
80
Actionability:
80
|
keep open | Feature request to warn when a part's source path resolves above Path.cwd() or is absolute, as these cause unexpected behavior in managed builds. Triaged by maintainer. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
29
Staleness:
55
Complexity:
35
Confidence:
75
Support Request:
10
|
keep open | Feature request to warn when a part's source path resolves outside Path.cwd(), preventing unexpected behavior in managed builds. Triaged by maintainer bepri; @lengau expanded scope to also warn on absolute paths. No implementation found in codebase. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
68
Complexity:
12
Confidence:
90
Support Request:
0
|
keep open | Request to add warnings for outward relative or absolute source paths that could resolve outside the project directory, preventing unexpected behavior in managed builds. Currently triaged but inactive. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
65
Complexity:
15
Confidence:
85
Support Request:
0
|
keep open | Feature request to warn when part sources use outward relative or absolute paths, which resolve incorrectly in managed LXD builds and cause failures. Currently triaged but inactive for ~7 months. |
Update history
No update history recorded yet.
Related issues
No related issues found above the similarity threshold.