
























@@ -4,6 +4,8 @@
44// prebuilt package artifact with dist inventory, not a source checkout.
55import { spawnSync } from "node:child_process";
66import fs from "node:fs";
7+import os from "node:os";
8+import path from "node:path";
79import { LOCAL_BUILD_METADATA_DIST_PATHS } from "./lib/local-build-metadata-paths.mjs";
810import { collectPackageDistImportErrors } from "./lib/package-dist-imports.mjs";
911@@ -32,6 +34,20 @@ if (list.status !== 0) {
3234fail(`tar -tf failed for ${tarball}: ${list.stderr || list.status}`);
3335}
343637+const extractDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-package-tarball-"));
38+try {
39+const extract = spawnSync("tar", ["-xf", tarball, "-C", extractDir], {
40+encoding: "utf8",
41+stdio: ["ignore", "pipe", "pipe"],
42+});
43+if (extract.status !== 0) {
44+fail(`tar -xf failed for ${tarball}: ${extract.stderr || extract.status}`);
45+}
46+} catch (error) {
47+fs.rmSync(extractDir, { recursive: true, force: true });
48+throw error;
49+}
50+3551const entries = list.stdout
3652.split(/\r?\n/u)
3753.map((entry) => entry.trim())
@@ -107,14 +123,13 @@ function isLegacyLocalBuildMetadataCompatVersion(version) {
107123}
108124109125function readTarEntry(entryPath) {
110-const candidates = [entryPath, `package/${entryPath}`];
126+const candidates = [
127+path.join(extractDir, entryPath),
128+path.join(extractDir, "package", entryPath),
129+];
111130for (const candidate of candidates) {
112-const result = spawnSync("tar", ["-xOf", tarball, candidate], {
113-encoding: "utf8",
114-stdio: ["ignore", "pipe", "pipe"],
115-});
116-if (result.status === 0) {
117-return result.stdout;
131+if (fs.existsSync(candidate)) {
132+return fs.readFileSync(candidate, "utf8");
118133}
119134}
120135return "";
@@ -204,10 +219,12 @@ errors.push(
204219);
205220206221if (errors.length > 0) {
222+fs.rmSync(extractDir, { recursive: true, force: true });
207223fail(`OpenClaw package tarball integrity failed:\n${errors.join("\n")}`);
208224}
209225210226for (const warning of warnings) {
211227console.warn(`OpenClaw package tarball integrity warning: ${warning}`);
212228}
229+fs.rmSync(extractDir, { recursive: true, force: true });
213230console.log("OpenClaw package tarball integrity passed.");
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。