Skip to content

Deletes that follow symbolic links: plugin, build script and runtime #227

Closed

Description

@b-re-w

Kotlin's deleteRecursively follows symbolic links, so deleting a directory that contains a link to outside deletes the outside target too (found in pypackpack #96 / toolchain #93, where call-site tests proved it on production paths).

Sites (listed by the PMM build supporter):

  • Gradle plugin: IosPythonHome.kt:222 home; PythonArtifactBindingsTask.kt:104 outputDirectory, :107 thunkRoot; PythonStubsTask.kt:89 destination.
  • python-multiplatform/build.gradle.kts:633 iosExtractDir, :1687 resultsDir, :1825 resultsRoot.
  • Runtime: PythonBootstrap.kt:150 payloadDir, :228 stdlibDir (Android); PythonPayload.desktop.kt:257 root (desktop).
    Safe already: PythonHomeStaging.kt:473, WasmBrowserRuntimeStaging.kt:75 (Gradle fs.delete).

Done when every site uses a delete that does not follow links, with regression tests (a link to an outside directory survives) observed red first.

Activity

  1. b-re-w commented on Oct 17, 2026

    @b-re-w
    MemberAuthor

    Landed in develop

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions