tar: Don't filter out toplevel /run, /proc etc

Otherwise we break things when using this code to process
a "non-ostree" image.

Signed-off-by: Colin Walters <[email protected]>

Author: cgwalters

lib/src/tar/write.rs

@@ -182,8 +182,12 @@ fn normalize_validate_path<'a>(
         ret.push(camino::Utf8Component::CurDir);
     }
     let mut found_first = false;
+    let mut excluded = false;
     for part in components {
         let part = part?;
+        if excluded {
+            return Ok(NormalizedPathResult::Filtered(part.as_str()));
+        }
         if !found_first {
             if let Utf8Component::Normal(part) = part {
                 found_first = true;
@@ -203,7 +207,10 @@ fn normalize_validate_path<'a>(
                         }
                     }
                     o if EXCLUDED_TOPLEVEL_PATHS.contains(&o) => {
-                        return Ok(NormalizedPathResult::Filtered(part));
+                        // We don't want to actually drop the toplevel, but mark
+                        // *children* of it as excluded.
+                        excluded = true;
+                        ret.push(part)
                     }
                     _ if config.allow_nonusr => ret.push(part),
                     _ => {
@@ -516,6 +523,8 @@ mod tests {
             ("usr///share/.//blah", "./usr/share/blah"),
             ("var/lib/blah", "./usr/share/factory/var/lib/blah"),
             ("./var/lib/blah", "./usr/share/factory/var/lib/blah"),
+            ("dev", "./dev"),
+            ("/proc", "./proc"),
             ("./", "."),
         ];
         let valid_nonusr = &[("boot", "./boot"), ("opt/puppet/blah", "./opt/puppet/blah")];

lib/tests/it/main.rs

@@ -395,7 +395,9 @@ async fn test_tar_write() -> Result<()> {
     .run()?;
     assert_eq!(r.filtered.len(), 1);
     assert!(r.filtered.get("var").is_none());
-    assert_eq!(*r.filtered.get("run").unwrap(), 2);
+    // TODO: change filter_tar to properly make this run/somefile, but eh...we're
+    // just going to accept this stuff in the future but ignore it anyways.
+    assert_eq!(*r.filtered.get("somefile").unwrap(), 1);
 
     Ok(())
 }