Use Astral-maintained tokio-tar fork

Cargo.toml

@@ -73,6 +73,7 @@ uv-workspace = { path = "crates/uv-workspace" }
 anstream = { version = "0.6.15" }
 anyhow = { version = "1.0.89" }
 arcstr = { version = "1.2.0" }
+astral-tokio-tar = { git = "https://github.com/astral-sh/tokio-tar", rev = "9b5e6929ab480daa411440fea2f2f7f378e71a97" }
 async-channel = { version = "2.3.1" }
 async-compression = { version = "0.4.12", features = ["bzip2", "gzip", "xz", "zstd"] }
 async-trait = { version = "0.1.82" }
@@ -118,7 +119,6 @@ indoc = { version = "2.0.5" }
 itertools = { version = "0.14.0" }
 jiff = { version = "0.1.14", features = ["serde"] }
 junction = { version = "1.2.0" }
-krata-tokio-tar = { version = "0.4.2" }
 mailparse = { version = "0.15.0" }
 md-5 = { version = "0.10.6" }
 memchr = { version = "2.7.4" }

crates/uv-extract/Cargo.toml

@@ -20,11 +20,11 @@ uv-configuration = { workspace = true }
 uv-distribution-filename = { workspace = true }
 uv-pypi-types = { workspace = true }
 
+astral-tokio-tar = { workspace = true }
 async-compression = { workspace = true, features = ["bzip2", "gzip", "zstd", "xz"] }
 async_zip = { workspace = true }
 fs-err = { workspace = true, features = ["tokio"] }
 futures = { workspace = true }
-krata-tokio-tar = { workspace = true }
 md-5 = { workspace = true }
 rayon = { workspace = true }
 reqwest = { workspace = true }

crates/uv-extract/src/lib.rs

@@ -5,5 +5,4 @@ mod error;
 pub mod hash;
 pub mod stream;
 mod sync;
-mod tar;
 mod vendor;

crates/uv-extract/src/stream.rs

@@ -3,6 +3,7 @@ use std::pin::Pin;
 
 use futures::StreamExt;
 use rustc_hash::FxHashSet;
+use tokio_tar::EntryType;
 use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
 use tracing::warn;
 
@@ -143,6 +144,16 @@ async fn untar_in(
     mut archive: tokio_tar::Archive<&'_ mut (dyn tokio::io::AsyncRead + Unpin)>,
     dst: &Path,
 ) -> std::io::Result<()> {
+    // Like `tokio-tar`, canonicalize the destination prior to unpacking.
+    let dst = fs_err::tokio::canonicalize(dst).await?;
+
+    // Memoize filesystem calls to canonicalize paths.
+    let mut memo = FxHashSet::default();
+
+    // Delay any directory entries until the end, to ensure that directory permissions do not
+    // interfere with descendant extraction.
+    let mut directories = Vec::new();
+
     let mut entries = archive.entries()?;
     let mut pinned = Pin::new(&mut entries);
     while let Some(entry) = pinned.next().await {
@@ -159,7 +170,15 @@ async fn untar_in(
             continue;
         }
 
-        file.unpack_in(dst).await?;
+        // Defer the creation of any directory entries.
+        if file.header().entry_type() == EntryType::Directory {
+            directories.push(file);
+            continue;
+        }
+
+        // Unpack the file into the destination directory.
+        #[cfg_attr(not(unix), allow(unused_variables))]
+        let unpacked_at = file.unpack_in_memo(&dst, &mut memo).await?;
 
         // Preserve the executable bit.
         #[cfg(unix)]
@@ -172,7 +191,7 @@ async fn untar_in(
                 let mode = file.header().mode()?;
                 let has_any_executable_bit = mode & 0o111;
                 if has_any_executable_bit != 0 {
-                    if let Some(path) = crate::tar::unpacked_at(dst, &file.path()?) {
+                    if let Some(path) = unpacked_at.as_deref() {
                         let permissions = fs_err::tokio::metadata(&path).await?.permissions();
                         if permissions.mode() & 0o111 != 0o111 {
                             fs_err::tokio::set_permissions(
@@ -186,6 +205,12 @@ async fn untar_in(
             }
         }
     }
+
+    // Create any deferred directories.
+    for mut dir in directories {
+        dir.unpack_in_memo(&dst, &mut memo).await?;
+    }
+
     Ok(())
 }
 

crates/uv-publish/Cargo.toml

@@ -25,13 +25,13 @@ uv-pypi-types = { workspace = true }
 uv-static = { workspace = true }
 uv-warnings = { workspace = true }
 
+astral-tokio-tar = { workspace = true }
 async-compression = { workspace = true }
 base64 = { workspace = true }
 fs-err = { workspace = true }
 futures = { workspace = true }
 glob = { workspace = true }
 itertools = { workspace = true }
-krata-tokio-tar = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 reqwest-retry = { workspace = true }