From f6d32e482a391ee9b095bb58f3476dd75420fc64 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Tue, 6 Jan 2026 05:55:24 +0900
Subject: [PATCH] internal/pkg: ensure parent for non-directory entries

This works around streams containing out of order entries.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 internal/pkg/tar.go | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/internal/pkg/tar.go b/internal/pkg/tar.go
index 0d1c572..5444aab 100644
--- a/internal/pkg/tar.go
+++ b/internal/pkg/tar.go
@@ -11,6 +11,7 @@ import (
 	"io/fs"
 	"net/http"
 	"os"
+	"path"
 
 	"hakurei.app/container/check"
 )
@@ -128,9 +129,14 @@ func (a *tarArtifact) Cure(c *CureContext) (err error) {
 				continue
 
 			case tar.TypeReg:
+				p := temp.Append(header.Name).String()
+				if err = os.MkdirAll(path.Dir(p), 0700); err != nil {
+					return
+				}
+
 				var f *os.File
 				if f, err = os.OpenFile(
-					temp.Append(header.Name).String(),
+					p,
 					os.O_CREATE|os.O_EXCL|os.O_WRONLY,
 					header.FileInfo().Mode()&0400,
 				); err != nil {
@@ -145,19 +151,21 @@ func (a *tarArtifact) Cure(c *CureContext) (err error) {
 				break
 
 			case tar.TypeLink:
-				if err = os.Link(
-					header.Linkname,
-					temp.Append(header.Name).String(),
-				); err != nil {
+				p := temp.Append(header.Name).String()
+				if err = os.MkdirAll(path.Dir(p), 0700); err != nil {
+					return
+				}
+				if err = os.Link(header.Linkname, p); err != nil {
 					return
 				}
 				break
 
 			case tar.TypeSymlink:
-				if err = os.Symlink(
-					header.Linkname,
-					temp.Append(header.Name).String(),
-				); err != nil {
+				p := temp.Append(header.Name).String()
+				if err = os.MkdirAll(path.Dir(p), 0700); err != nil {
+					return
+				}
+				if err = os.Symlink(header.Linkname, p); err != nil {
 					return
 				}
 				break