← Back to issue list

Warn on outward relative path sources

View original Github issue

Metadata

Project
craft-parts
Number
#1390
Type
issue
State
open
Author
bepri
Labels
Status: Triaged
Created
Updated
Closed

Current evaluation

Feature request to warn when a part's source path resolves outside Path.cwd(), preventing unexpected behavior in managed builds. Triaged by maintainer bepri; @lengau expanded scope to also warn on absolute paths. No implementation found in codebase.

Suggested action: keep open

Reason: Issue is triaged (Status: Triaged label), authored by maintainer bepri, and has a follow-up comment from @lengau expanding scope to absolute paths. Code inspection confirms no outward-path warning exists in local_source.py or git_source.py. The feature is still relevant and unimplemented.

Impact: 45 Quick Win: 29.25 Staleness: 55 Complexity: 35 Confidence: 75 Support Request: 10

Issue body

### What needs to get done A warning should be raised when a part with a source above `Path.cwd()` is parsed. This works in destructive mode, but it will almost always fail in managed builds. ### Why it needs to get done Currently, supplying a relative path for a `source:` isn't supported and can very easily lead to unexpected behavior. Consider the following project structure: ``` ├── misc │   └── packaging │   └── snap │   └── snapcraft.yaml └── src └── main.c ``` And a part with the following: ```yaml parts: plugin: [any] source: ../../../ source-type: [git or local] ``` Once this gets into a LXD build environment, `../../../` will always resolve to `/`. Then, depending on the file-type, you can get behaviors ranging from "not a git directory" (from `source-type: git`) to disk space errors due to it attempting to copy _the entire root_ (from `source-type: local`). Since this _could_ be a desired behavior, but is almost certainly not, a warning should be issued in this case.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 45
Quick Win: 29.25
Staleness: 55
Complexity: 35
Confidence: 75
Support Request: 10
keep open Feature request to warn when a part's source path resolves outside Path.cwd(), preventing unexpected behavior in managed builds. Triaged by maintainer bepri; @lengau expanded scope to also warn on absolute paths. No implementation found in codebase.
qwen/qwen3.6-35b-a3b
Staleness: 68
Complexity: 12
Confidence: 90
Support Request: 0
keep open Request to add warnings for outward relative or absolute source paths that could resolve outside the project directory, preventing unexpected behavior in managed builds. Currently triaged but inactive.
qwen3.6-35b-a3b-mtp-q6
Staleness: 65
Complexity: 15
Confidence: 85
Support Request: 0
keep open Feature request to warn when part sources use outward relative or absolute paths, which resolve incorrectly in managed LXD builds and cause failures. Currently triaged but inactive for ~7 months.
qwen3.6-35b-a3b-mtp-q6
Staleness: 65
Complexity: 20
Confidence: 85
Support Request: 0
keep open Warn on outward relative and absolute paths in part sources to prevent build failures in managed environments. Currently triaged and under discussion, with recent feedback to expand warnings to absolute paths. Awaiting implementation.

Update history

No update history recorded yet.

Related issues

No related issues found above the similarity threshold.