Description
When a package has no sha256 declared (e.g. mcpp), a partial/corrupt download can be accepted and cached. On retry (e.g. after switching mirrors), the stale file passes all checks and extraction fails with Truncated tar archive.
Steps to Reproduce
xlings install mcpp -y- Download starts, gets partway through (e.g. 0.0% → partial file written)
- Connection drops or user switches mirror
- Retry the install — extraction fails with
read_data_block: Truncated tar archive detected
Root Cause
The mcpp package (and other XLINGS_RES packages) declares no sha256 checksum. This disables nearly all integrity verification:
onVerify callback — skipped (downloader.cppm:462, only set when !task.sha256.empty())- Final SHA256 re-check — skipped (
downloader.cppm:505)
- Only protection — size check rejecting files < 1024 bytes (
downloader.cppm:489)
The114KB partial file passes the size check. Additionally, the HEAD-based cache path (downloader.cppm:362-410) has an "airline-friendly" fallback: when HEAD fails and a cached file exists with size > 0, it's used as-is — even if truncated.
Observed Behavior
[error] extract failed for mcpp: read_data_block: Truncated tar archive detected while reading data
[error] [mcpp] failed: read_data_block: Truncated tar archive detected while reading data
Cached file: ~/.xlings/data/runtimedir/mcpp-0.0.81-linux-x86_64.tar.gz — only 114KB (expected ~30MB+).
Expected Behavior
A partial/corrupt download should be detected and re-downloaded, not accepted into cache.
Suggested Fix
- Add sha256 checksums to all
XLINGS_RES package versions (strongest fix)
- Enhance size validation when sha256 is absent: compare downloaded file size against
Content-Length from the HTTP response, and reject mismatches
- Validate archive readability before accepting into cache (try
libarchive open + read first header)
- Remove the "airline-friendly" HEAD-fail fallback for archives without sha256 — a corrupt cached archive is worse than a re-download
Environment
- xlings version: current (built from source)
- Platform: Linux x86_64
- Package:
mcpp@0.0.81
Description
When a package has no sha256 declared (e.g.
mcpp), a partial/corrupt download can be accepted and cached. On retry (e.g. after switching mirrors), the stale file passes all checks and extraction fails withTruncated tar archive.Steps to Reproduce
xlings install mcpp -yread_data_block: Truncated tar archive detectedRoot Cause
The
mcpppackage (and otherXLINGS_RESpackages) declares nosha256checksum. This disables nearly all integrity verification:onVerifycallback — skipped (downloader.cppm:462, only set when!task.sha256.empty())downloader.cppm:505)downloader.cppm:489)The114KB partial file passes the size check. Additionally, the HEAD-based cache path (
downloader.cppm:362-410) has an "airline-friendly" fallback: when HEAD fails and a cached file exists withsize > 0, it's used as-is — even if truncated.Observed Behavior
Cached file:
~/.xlings/data/runtimedir/mcpp-0.0.81-linux-x86_64.tar.gz— only 114KB (expected ~30MB+).Expected Behavior
A partial/corrupt download should be detected and re-downloaded, not accepted into cache.
Suggested Fix
XLINGS_RESpackage versions (strongest fix)Content-Lengthfrom the HTTP response, and reject mismatcheslibarchiveopen + read first header)Environment
mcpp@0.0.81