Skip to content

fix: preserve nested archives which fail to extract#1383

Merged
stevebeattie merged 1 commit into
chainguard-dev:mainfrom
egibs:nested-archive-persistence
Feb 17, 2026
Merged

fix: preserve nested archives which fail to extract#1383
stevebeattie merged 1 commit into
chainguard-dev:mainfrom
egibs:nested-archive-persistence

Conversation

@egibs
Copy link
Copy Markdown
Member

@egibs egibs commented Feb 17, 2026

We currently remove all nested archives regardless of whether they've been extracted successfully or not. In cases where an archive does not extract successfully, we can instead leave it as-is which will allow malcontent to run a best-effort scan against the archive. This was originally a debug message and is now a warning so that it's much more obvious when this happens.

While this will not be nearly as accurate scanning an archive's constituent files, any scan results are better than no scan at all. This PR also adds two tests to ensure that we align with the expected behavior depending on whether ExitExtraction is in use or not.

@egibs egibs requested a review from stevebeattie February 17, 2026 22:12
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
@egibs egibs force-pushed the nested-archive-persistence branch from 074a66c to 51db4da Compare February 17, 2026 22:15
@egibs egibs marked this pull request as ready for review February 17, 2026 22:16
@stevebeattie stevebeattie merged commit 356c566 into chainguard-dev:main Feb 17, 2026
18 checks passed
@egibs egibs deleted the nested-archive-persistence branch February 18, 2026 13:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants