security(macos): give archive deduplication a private, unpredictable scratch directory

[Guikingone]

Closes #889.

What was wrong

macOS whole-archive deduplication wrote its copies into <tmp>/elephc-link-dedup-<pid>, created with create_dir_all — which succeeds on a directory that already exists — and copied archives in with fs::copy, which follows a symlink at the destination.

On a multi-user machine another local user could predict or race the compiler's pid, pre-create that directory with permissive access, and plant a symlink named after a bridge archive. The copy would then truncate and overwrite the symlink's target with the compiler user's permissions. The path is reached whenever at least two whole-archived bridges need deduplication.

Fix

Guarantee	How
unpredictable	mkdtemp(3) — six characters of kernel-chosen randomness, no pid in the name
exclusive	mkdtemp creates or fails; a planted directory cannot be adopted
owner-only	mode 0700 from the moment it exists, with no window between creation and a permission fixup
no symlink follow	copies go through OpenOptions::create_new (O_CREAT | O_EXCL), which refuses to follow a symlink and fails if anything already sits at the destination
fails closed	no private scratch → the plan is returned unchanged and the link proceeds with the original archives

Failing closed is the right trade here: deduplication is an optimization, and a predictable scratch path is not an acceptable price for it.

create_new is the second lock on the same door — the private directory already makes a planted symlink unreachable — but the issue asks for it and it costs nothing.

Cleanup is unchanged: PreparedArchives::cleanup still removes the directory after the linker has consumed the plan.

Tests

• scratch_is_unpredictable_private_and_fresh — two scratch paths differ, neither contains the pid, both are 0700 directories and empty
• an_existing_destination_is_refused_not_followed — a symlink planted at a destination name is refused by create_new, and its target still holds its original bytes

cargo test --bin elephc (1903) passes; cargo build is warning-free.

Note: these live in the binary crate — src/linker is declared in src/main.rs, not src/lib.rs — so they run under cargo test --bin elephc, not --lib.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KSAAWPyNBq6dP2b5puN3wr

[greptile-apps]

Greptile Summary

This PR secures macOS whole-archive deduplication and updates the copy path following the previous review.

• Creates an unpredictable, exclusive, owner-only scratch directory with mkdtemp.
• Opens destination archives exclusively with create_new to prevent symlink following.
• Streams archive contents with bounded memory instead of loading each archive in full.
• Adds regression tests for scratch-directory properties and refusal of existing destinations.

Confidence Score: 5/5

The PR appears safe to merge; the previously reported whole-archive memory spike has been fully addressed by streaming the source into the exclusive destination.

No blocking or non-blocking actionable issues remain. The prior Greptile thread is manually resolved, and the current implementation replaces the full-file read with std::io::copy while preserving exclusive destination creation.

Important Files Changed

Filename	Overview
src/linker/archive_dedup.rs	Replaces predictable scratch storage and symlink-following copies with private exclusive creation, bounded-memory streaming, fail-closed behavior, and focused regression tests.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Link plan] --> B{Deduplication needed?}
    B -- No --> C[Return unchanged plan]
    B -- Yes --> D{Create private scratch directory}
    D -- Failure --> C
    D -- Success --> E[Open source archive]
    E --> F{Exclusively create destination}
    F -- Failure --> G[Keep original archive]
    F -- Success --> H[Stream archive contents]
    H --> I[Strip duplicate members]
    I --> J[Replace archive in prepared plan]
    J --> K[Linker consumes plan]
    K --> L[Cleanup scratch directory]

Loading

_{Reviews (2): Last reviewed commit: "perf(linker): stream the deduplication c..." | Re-trigger Greptile}

[nahime0]

@Guikingone is this ready? for me can be merged, but you didn't ask for my review :) let me know if I can merge it

[Guikingone]

Ah yes, forgot about it 😄

Ready for review / merge 🙂

[nahime0]

lgtm