test: glob_files_rec with a relative path

[rgrinberg]

We demonstrate that using relative paths in [glob_files_rec] has
unintended consequences. In this test, we install some artifacts outside
the package directory just by globbing from a parent dir.

Signed-off-by: Rudi Grinberg me@rgrinberg.com

[rgrinberg]

Improved the test to describe the issue better.

How should we go about the fix? I've copied @anmonteiro because he dealt with a similar issue with runtime_deps.

One way would be to allow users to explicitly write out the prefix. E.g. (glob_files_rec ../foo/*.txt as foo/) similar to how we have as for normal installed files.

[anmonteiro]

For the Melange rules we added a check that the runtime assets must be present under the source tree where the library is defined:

dune/src/dune_rules/install_rules.ml

Lines 46 to 63 in dfb6330

	let check_runtime_deps_relative_path local_path ~loc ~lib_info =
	let lib_src_dir = Lib_info.src_dir lib_info in
	match
	Path.Local.descendant local_path ~of_:(Path.Build.local lib_src_dir)
	with
	| None ->
	User_error.raise ~loc
	[ Pp.textf
	"Public library `%s' depends on assets outside its source tree. This \
	is not allowed."
	(lib_info |> Lib_info.name |> Lib_name.to_string)
	]
	~hints:
	[ Pp.textf
	"Move the dependency to a descendant of the folder where the \
	library is defined"
	]
	| Some _ -> ()

[gridbugs]

I'm looking into this now. I noticed that the non-recursive glob_files is also affected. Also it's currently possible to get this behaviour without any globs by writing (files (../stuff/foo.txt as ../stuff/foo.txt)). Dune will happily let you install files outside the current package if the as keyword specifies a relative path as the destination.

I'm going to do two things to fix this:

1. add a check that ensures the destination of an install file entry is a descendant of the package's directory.
2. as (1) will prevent an install file entry from using globs beginning with .. I'll add some syntax for changing the prefix of files matched by a glob as @rgrinberg suggested.