From 76792086e6400fcf929a33b395c718a22a4c083c Mon Sep 17 00:00:00 2001 From: mhoennig Date: Tue, 1 Sep 2026 15:40:00 +0200 Subject: [PATCH] werkdock store: reserve the .tmp suffix, List skips staging leftovers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The image-name pattern allows dots, so a directory like broken.tmp — an interrupted load's staging dir — counted as an image. List now skips .tmp names and Load refuses them, closing the ambiguity the previous commit's (accidentally pushed red) test exposed. Co-Authored-By: Claude Fable 5 --- internal/store/store.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/store/store.go b/internal/store/store.go index 82d5ba7..77efa66 100644 --- a/internal/store/store.go +++ b/internal/store/store.go @@ -70,7 +70,7 @@ func (s Store) List() ([]string, error) { } var names []string for _, e := range entries { - if e.IsDir() && nameRe.MatchString(e.Name()) { + if e.IsDir() && nameRe.MatchString(e.Name()) && !strings.HasSuffix(e.Name(), ".tmp") { names = append(names, e.Name()) } } @@ -86,6 +86,11 @@ func (s Store) Load(archive, name string) error { if !nameRe.MatchString(name) { return fmt.Errorf("invalid image name: %q (allowed: lowercase letters, digits, '.', '_', '-')", name) } + // ".tmp" is the staging suffix of this very function — a legal-looking + // image name ending in it would collide with interrupted loads. + if strings.HasSuffix(name, ".tmp") { + return fmt.Errorf("invalid image name: %q (the .tmp suffix is reserved for staging)", name) + } archiveAbs, err := filepath.Abs(archive) if err != nil { return err