@automattic/vip 4.1.2 → 4.1.4

package/internal/parity/pendo_test.go

@@ -0,0 +1,122 @@
+//go:build parity
+
+package parity
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	json "encoding/json/v2"
+	"github.com/Automattic/vip/internal/debuglog"
+	"github.com/Automattic/vip/internal/telemetry"
+)
+
+// Compare the real clients and HTTP stacks against an authenticated local
+// endpoint. Only credential lookup is injected; no real analytics or user
+// keychain is touched. The ordinary CLI parity harness disables telemetry.
+func TestPendoClientParity(t *testing.T) {
+	node := ResolveNodeVipBin(os.Getenv("NODE_VIP_BIN"), DefaultNodeVipBinProbe())
+	if !node.Ready {
+		t.Skip(LoudSkip("Pendo real Node-vs-Go client comparison", node.Reason))
+	}
+	dist := filepath.Dir(filepath.Dir(node.Path))
+	for _, tc := range []struct {
+		name   string
+		status int
+		token  string
+	}{
+		{"accepted", 200, "credential-sentinel"},
+		{"unauthorized", 401, "credential-sentinel"},
+		{"server-error", 500, "credential-sentinel"},
+		{"no-token", 200, ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var observations [2][]map[string]any
+			for side := range 2 {
+				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					body, _ := io.ReadAll(r.Body)
+					var payload map[string]any
+					if err := json.Unmarshal(body, &payload); err != nil {
+						t.Error(err)
+					}
+					if payload["timestamp"] == nil {
+						t.Error("missing timestamp")
+					}
+					delete(payload, "timestamp")
+					observations[side] = append(observations[side], map[string]any{"path": r.URL.Path, "method": r.Method, "auth": r.Header.Get("Authorization"), "payload": payload})
+					status := tc.status
+					if r.Header.Get("Authorization") != "Bearer credential-sentinel" {
+						status = http.StatusUnauthorized
+					}
+					w.WriteHeader(status)
+					_, _ = w.Write([]byte("response-sentinel"))
+				}))
+				var diagnostics bytes.Buffer
+				if side == 0 {
+					const script = `
+const path = require('path');
+const dist = process.argv[1];
+const Token = require(path.join(dist, 'lib/token.js')).default;
+Token.get = async () => ({ raw: process.env.PENDO_FIXTURE_TOKEN });
+const Pendo = require(path.join(dist, 'lib/analytics/clients/pendo.js')).default;
+const c = new Pendo({ userId: 'visitor-sentinel', eventPrefix: 'vip_cli_', env: { userAgent: 'fixture' } });
+c.trackEvent('test', { org_slug: 'org-sentinel', org_sfid: 'account-sentinel' }).then(result => {
+  process.stdout.write(result === false ? 'failed' : 'accepted');
+}).catch(() => { process.exitCode = 1; });
+`
+					ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+					cmd := exec.CommandContext(ctx, "node", "-e", script, dist)
+					cmd.Env = FixtureEnv(map[string]string{"API_HOST": srv.URL, "PENDO_FIXTURE_TOKEN": tc.token, "DEBUG": "@automattic/vip:analytics:clients:pendo"})
+					cmd.Stderr = &diagnostics
+					out, err := cmd.Output()
+					cancel()
+					if err != nil {
+						srv.Close()
+						t.Fatalf("Node: %v\n%s", err, &diagnostics)
+					}
+					want := "failed"
+					if tc.token != "" && tc.status == 200 {
+						want = "accepted"
+					}
+					if string(out) != want {
+						t.Errorf("Node delivery result=%s, want %s", out, want)
+					}
+				} else {
+					c := &telemetry.PendoClient{Endpoint: srv.URL + "/pendo", HTTP: srv.Client(), UserID: "visitor-sentinel", UserAgent: "fixture", EventPrefix: "vip_cli_", GetToken: func() (string, error) { return tc.token, nil }, Context: debuglog.WithLogger(context.Background(), "@automattic/vip:analytics:clients:pendo", &diagnostics)}
+					err := c.TrackEvent("test", map[string]any{"org_slug": "org-sentinel", "org_sfid": "account-sentinel"})
+					if (err != nil) != (tc.token != "" && tc.status != 200) {
+						t.Errorf("Go delivery error=%v for HTTP %d", err, tc.status)
+					}
+				}
+				srv.Close()
+				wantRequests := 1
+				if tc.token == "" {
+					wantRequests = 0
+				}
+				if len(observations[side]) != wantRequests {
+					t.Errorf("side %d requests=%d, want %d", side, len(observations[side]), wantRequests)
+				}
+				if tc.token != "" && !strings.Contains(diagnostics.String(), fmt.Sprint(tc.status)) {
+					t.Errorf("side %d missing HTTP status: %s", side, &diagnostics)
+				}
+				if strings.Contains(diagnostics.String(), "sentinel") {
+					t.Errorf("side %d exposed private data: %s", side, &diagnostics)
+				}
+			}
+			if !reflect.DeepEqual(observations[0], observations[1]) {
+				t.Errorf("request mismatch: Node=%v Go=%v", observations[0], observations[1])
+			}
+		})
+	}
+}

package/internal/rechallenge/flow.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // Tracker is the minimal telemetry interface the runner needs.
@@ -121,6 +123,7 @@ func (r *Runner) Run(ctx context.Context, in RunInput) (*ElevatedToken, error) {
 		return nil, NewInteractionRequiredError(scope)
 	}
 
+	debuglog.Printf(ctx, "@automattic/vip:rechallenge:client", "createSession scope=%s", scope)
 	session, err := r.Client.CreateSession(CreateSessionInput{
 		Path:               in.Extension.CreateSessionPath,
 		RequestedOperation: scope,
@@ -182,6 +185,11 @@ func (r *Runner) Run(ctx context.Context, in RunInput) (*ElevatedToken, error) {
 		}
 
 		if !ss.Status.IsTerminal() {
+			status := "unknown"
+			if ss.Status == StatusPending {
+				status = "pending"
+			}
+			debuglog.Printf(ctx, "@automattic/vip:rechallenge:flow", "still %s; polling again", status)
 			continue
 		}
 

package/internal/rechallenge/flow_test.go

@@ -11,6 +11,8 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 type fakeTracker struct {
@@ -77,7 +79,9 @@ func TestFlowHappyPathVerified(t *testing.T) {
 		Sleep:      func(_ context.Context, _ time.Duration) error { return nil },
 	}
 
-	tok, err := r.Run(context.Background(), RunInput{
+	var diagnostics bytes.Buffer
+	debugCtx := debuglog.WithLogger(context.Background(), "@automattic/vip:rechallenge:*", &diagnostics)
+	tok, err := r.Run(debugCtx, RunInput{
 		RequestedOperation: "doThing",
 		Interactive:        true,
 		Extension: Extension{
@@ -94,6 +98,16 @@ func TestFlowHappyPathVerified(t *testing.T) {
 	if tok.Token != "opaque" {
 		t.Errorf("token = %q", tok.Token)
 	}
+	for _, want := range []string{"createSession scope=doThing", "still pending; polling again"} {
+		if !strings.Contains(diagnostics.String(), want) {
+			t.Errorf("missing %q in diagnostics: %q", want, diagnostics.String())
+		}
+	}
+	for _, secret := range []string{"opaque", "https://example/v/c1"} {
+		if strings.Contains(diagnostics.String(), secret) {
+			t.Fatal("rechallenge diagnostic leaked credentials")
+		}
+	}
 	if atomic.LoadInt32(&openCalled) != 1 {
 		t.Errorf("OpenURL called %d times, want 1", openCalled)
 	}

package/internal/releasepromotion/buildkite.go

@@ -97,8 +97,19 @@ func (c *BuildkiteClient) DownloadArtifacts(ctx context.Context, build Build, ro
 		return fmt.Errorf("create artifact directory: %w", err)
 	}
 
+	existing, err := os.ReadDir(root)
+	if err != nil {
+		return fmt.Errorf("read artifact directory: %w", err)
+	}
+	if len(existing) != 0 {
+		return fmt.Errorf("artifact directory must be empty; refusing to mix artifacts from different builds")
+	}
+
 	for _, artifactPath := range expectedArtifactPaths {
-		artifact := manifest[artifactPath]
+		artifact, ok := manifest[artifactPath]
+		if !ok {
+			continue
+		}
 		if artifact.DownloadURL == "" {
 			return fmt.Errorf("artifact %q has no download URL", artifactPath)
 		}

package/internal/releasepromotion/buildkite_test.go

@@ -251,3 +251,34 @@ func writeJSON(t *testing.T, w http.ResponseWriter, value any) {
 		t.Fatal(err)
 	}
 }
+
+func TestDownloadArtifactsRejectsStaleOptionalInstallers(t *testing.T) {
+	server := newBuildkiteServer(t, func(w http.ResponseWriter, r *http.Request) {
+		if !strings.HasSuffix(r.URL.Path, "/artifacts") {
+			t.Errorf("unexpected download into nonempty directory: %s", r.URL)
+			w.WriteHeader(500)
+			return
+		}
+		var artifacts []Artifact
+		for _, p := range ExpectedArtifactPaths() {
+			if strings.Contains(p, ".tar.gz") {
+				artifacts = append(artifacts, Artifact{Path: p, State: "finished", DownloadURL: "https://example.invalid/download"})
+			}
+		}
+		writeJSON(t, w, artifacts)
+	})
+	defer server.Close()
+	root := t.TempDir()
+	stale := filepath.Join(root, "vip-next-darwin-amd64.pkg")
+	if err := os.WriteFile(stale, []byte("previous build"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	err := testBuildkiteClient(server.URL).DownloadArtifacts(context.Background(), Build{Number: 28}, root)
+	if err == nil || !strings.Contains(err.Error(), "must be empty") {
+		t.Fatalf("accepted stale artifact: %v", err)
+	}
+	got, err := os.ReadFile(stale)
+	if err != nil || string(got) != "previous build" {
+		t.Fatalf("changed existing artifact: %q %v", got, err)
+	}
+}

package/internal/releasepromotion/contract.go

@@ -2,7 +2,9 @@ package releasepromotion
 
 import (
 	"fmt"
+	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
@@ -18,6 +20,12 @@ const (
 var prereleaseVersionPattern = regexp.MustCompile(`^5\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-(alpha|beta|rc)\.(0|[1-9][0-9]*)$`)
 
 var expectedArtifactPaths = []string{
+	"dist/vip-next-darwin-amd64.pkg",
+	"dist/vip-next-darwin-amd64.pkg.sha256",
+	"dist/vip-next-darwin-arm64.pkg",
+	"dist/vip-next-darwin-arm64.pkg.sha256",
+	"dist/vip-next-windows-amd64.msi",
+	"dist/vip-next-windows-amd64.msi.sha256",
 	"dist/vip-next-darwin-amd64.tar.gz",
 	"dist/vip-next-darwin-amd64.tar.gz.sha256",
 	"dist/vip-next-darwin-arm64.tar.gz",
@@ -88,7 +96,16 @@ func ValidateArtifactManifest(artifacts []Artifact) (map[string]Artifact, error)
 	var missing []string
 	for _, artifactPath := range expectedArtifactPaths {
 		if _, ok := manifest[artifactPath]; !ok {
-			missing = append(missing, artifactPath)
+			// Portable binaries are mandatory. Installers are optional, but a
+			// package and its checksum must always be present together.
+			companion := strings.TrimSuffix(artifactPath, ".sha256")
+			if companion == artifactPath {
+				companion += ".sha256"
+			}
+			_, paired := manifest[companion]
+			if strings.Contains(artifactPath, ".tar.gz") || paired {
+				missing = append(missing, artifactPath)
+			}
 		}
 	}
 
@@ -115,3 +132,34 @@ func ValidateArtifactManifest(artifacts []Artifact) (map[string]Artifact, error)
 
 	return manifest, nil
 }
+
+// localArtifactPaths applies the same contract to downloads before upload. It
+// also rejects unknown files and non-regular entries instead of publishing them.
+func localArtifactPaths(root string) ([]string, error) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return nil, err
+	}
+	var artifacts []Artifact
+	for _, entry := range entries {
+		info, err := entry.Info()
+		if err != nil {
+			return nil, err
+		}
+		if !info.Mode().IsRegular() {
+			return nil, fmt.Errorf("replacement asset %q is not a regular file", entry.Name())
+		}
+		artifacts = append(artifacts, Artifact{Path: "dist/" + entry.Name(), State: "finished"})
+	}
+	manifest, err := ValidateArtifactManifest(artifacts)
+	if err != nil {
+		return nil, err
+	}
+	paths := make([]string, 0, len(manifest))
+	for _, p := range expectedArtifactPaths {
+		if _, ok := manifest[p]; ok {
+			paths = append(paths, filepath.Base(p))
+		}
+	}
+	return paths, nil
+}

package/internal/releasepromotion/contract_test.go

@@ -16,6 +16,8 @@ func TestValidateRequest(t *testing.T) {
 		{"5.0.0-beta.1", "refs/heads/trunk", true},
 		{"5.12.3-alpha.10", "refs/heads/trunk", true},
 		{"5.1.0-rc.2", "refs/heads/trunk", true},
+		{"5.0.0-beta.200", "refs/heads/trunk", true},
+		{"5.0.65-alpha.1", "refs/heads/trunk", true},
 		{"5.0.0", "refs/heads/trunk", false},
 		{"v5.0.0-beta.1", "refs/heads/trunk", false},
 		{"4.9.0-beta.1", "refs/heads/trunk", false},
@@ -34,6 +36,42 @@ func TestValidateRequest(t *testing.T) {
 	}
 }
 
+func TestManifestAllowsMissingInstallerPairs(t *testing.T) {
+	var artifacts []Artifact
+	for _, p := range ExpectedArtifactPaths() {
+		if strings.Contains(p, ".tar.gz") {
+			artifacts = append(artifacts, Artifact{Path: p, State: "finished"})
+		}
+	}
+	if _, err := ValidateArtifactManifest(artifacts); err != nil {
+		t.Fatal(err)
+	}
+	artifacts = append(artifacts, Artifact{Path: "dist/vip-next-windows-amd64.msi", State: "finished"}, Artifact{Path: "dist/vip-next-windows-amd64.msi.sha256", State: "finished"})
+	if _, err := ValidateArtifactManifest(artifacts); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestManifestRejectsPartialInstallerPairs(t *testing.T) {
+	for _, missing := range []string{
+		"dist/vip-next-darwin-amd64.pkg", "dist/vip-next-darwin-amd64.pkg.sha256",
+		"dist/vip-next-darwin-arm64.pkg", "dist/vip-next-darwin-arm64.pkg.sha256",
+		"dist/vip-next-windows-amd64.msi", "dist/vip-next-windows-amd64.msi.sha256",
+	} {
+		t.Run(missing, func(t *testing.T) {
+			var artifacts []Artifact
+			for _, p := range ExpectedArtifactPaths() {
+				if p != missing {
+					artifacts = append(artifacts, Artifact{Path: p, State: "finished"})
+				}
+			}
+			if _, err := ValidateArtifactManifest(artifacts); err == nil || !strings.Contains(err.Error(), missing) {
+				t.Fatalf("missing installer artifact accepted: %v", err)
+			}
+		})
+	}
+}
+
 func TestValidateArtifactManifest(t *testing.T) {
 	t.Parallel()
 	expected := ExpectedArtifactPaths()

package/internal/releasepromotion/github.go

@@ -172,14 +172,9 @@ func (c *GitHubClient) ReplaceAssets(ctx context.Context, release Release, root
 			return fmt.Errorf("unexpected existing asset %q on draft release", asset.Name)
 		}
 	}
-	for name := range expectedNames {
-		info, err := os.Stat(filepath.Join(root, name))
-		if err != nil {
-			return fmt.Errorf("read replacement asset %q: %w", name, err)
-		}
-		if !info.Mode().IsRegular() {
-			return fmt.Errorf("replacement asset %q is not a regular file", name)
-		}
+	paths, err := localArtifactPaths(root)
+	if err != nil {
+		return fmt.Errorf("read replacement assets: %w", err)
 	}
 
 	for _, asset := range release.Assets {
@@ -193,8 +188,7 @@ func (c *GitHubClient) ReplaceAssets(ctx context.Context, release Release, root
 	if uploadBase == "" {
 		uploadBase = fmt.Sprintf("%s/repos/%s/releases/%d/assets", c.uploadsURL(), GitHubRepository, release.ID)
 	}
-	for _, artifactPath := range expectedArtifactPaths {
-		name := filepath.Base(artifactPath)
+	for _, name := range paths {
 		if err := c.uploadAsset(ctx, uploadBase, name, filepath.Join(root, name)); err != nil {
 			return err
 		}

package/internal/releasepromotion/optional_installers_test.go

@@ -0,0 +1,87 @@
+package releasepromotion
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+)
+
+func TestDownloadVerifyAndReplaceWithOptionalInstallers(t *testing.T) {
+	for _, windowsInstaller := range []bool{false, true} {
+		name := "binaries-only"
+		if windowsInstaller {
+			name = "binaries-and-windows-installer"
+		}
+		t.Run(name, func(t *testing.T) {
+			fixtures := t.TempDir()
+			writeCompleteArtifactSet(t, fixtures)
+			var expected, uploaded []string
+			var artifacts []Artifact
+			var serverURL string
+			deleted := false
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch {
+				case strings.HasSuffix(r.URL.Path, "/artifacts"):
+					writeJSON(t, w, artifacts)
+				case strings.HasPrefix(r.URL.Path, "/download/"):
+					data, err := os.ReadFile(filepath.Join(fixtures, filepath.Base(r.URL.Path)))
+					if err != nil {
+						t.Error(err)
+						w.WriteHeader(404)
+						return
+					}
+					_, _ = w.Write(data)
+				case r.Method == http.MethodDelete:
+					deleted = true
+					w.WriteHeader(http.StatusNoContent)
+				case r.Method == http.MethodPost && r.URL.Path == "/uploads":
+					name := r.URL.Query().Get("name")
+					data, _ := io.ReadAll(r.Body)
+					original, err := os.ReadFile(filepath.Join(fixtures, name))
+					if err != nil || string(data) != string(original) {
+						t.Errorf("uploaded wrong bytes for %s: %v", name, err)
+					}
+					uploaded = append(uploaded, name)
+					w.WriteHeader(http.StatusCreated)
+				default:
+					t.Errorf("unexpected request %s %s", r.Method, r.URL)
+					w.WriteHeader(500)
+				}
+			}))
+			defer server.Close()
+			serverURL = server.URL
+			for _, p := range ExpectedArtifactPaths() {
+				if !strings.Contains(p, ".tar.gz") && !(windowsInstaller && strings.Contains(p, ".msi")) {
+					continue
+				}
+				expected = append(expected, filepath.Base(p))
+				artifacts = append(artifacts, Artifact{Path: p, State: "finished", DownloadURL: serverURL + "/download/" + filepath.Base(p)})
+			}
+			downloads := t.TempDir()
+			if err := testBuildkiteClient(server.URL).DownloadArtifacts(context.Background(), Build{Number: 28}, downloads); err != nil {
+				t.Fatal(err)
+			}
+			if err := VerifyDownloads(downloads); err != nil {
+				t.Fatal(err)
+			}
+			// A retry also removes an old optional installer from the draft when the
+			// current exact build did not produce it.
+			release := Release{ID: 1, Draft: true, UploadURL: server.URL + "/uploads{?name,label}", Assets: []ReleaseAsset{{ID: 9, Name: "vip-next-darwin-amd64.pkg"}}}
+			if err := testGitHubClient(server.URL).ReplaceAssets(context.Background(), release, downloads); err != nil {
+				t.Fatal(err)
+			}
+			sort.Strings(expected)
+			sort.Strings(uploaded)
+			if !deleted || !reflect.DeepEqual(expected, uploaded) {
+				t.Fatalf("deleted=%t uploaded=%v want=%v", deleted, uploaded, expected)
+			}
+		})
+	}
+}

package/internal/releasepromotion/verify.go

@@ -3,6 +3,7 @@ package releasepromotion
 import (
 	"archive/tar"
 	"bufio"
+	"bytes"
 	"compress/gzip"
 	"crypto/sha256"
 	"crypto/subtle"
@@ -20,8 +21,12 @@ var unixEntries = map[string]struct{}{"vip-next": {}, "go-search-replace": {}}
 var windowsEntries = map[string]struct{}{"vip-next.exe": {}, "go-search-replace.exe": {}}
 
 func VerifyDownloads(root string) error {
-	for _, artifactPath := range expectedArtifactPaths {
-		if !strings.HasSuffix(artifactPath, ".tar.gz") {
+	paths, err := localArtifactPaths(root)
+	if err != nil {
+		return err
+	}
+	for _, artifactPath := range paths {
+		if strings.HasSuffix(artifactPath, ".sha256") {
 			continue
 		}
 		archivePath := filepath.Join(root, filepath.Base(artifactPath))
@@ -29,6 +34,12 @@ func VerifyDownloads(root string) error {
 		if err := verifyChecksum(archivePath, checksumPath); err != nil {
 			return fmt.Errorf("verify %s: %w", filepath.Base(archivePath), err)
 		}
+		if !strings.HasSuffix(artifactPath, ".tar.gz") {
+			if err := verifyInstallerContainer(archivePath); err != nil {
+				return fmt.Errorf("verify %s: %w", filepath.Base(archivePath), err)
+			}
+			continue
+		}
 		expected := unixEntries
 		if strings.Contains(filepath.Base(archivePath), "-windows-") {
 			expected = windowsEntries
@@ -40,6 +51,33 @@ func VerifyDownloads(root string) error {
 	return nil
 }
 
+// Platform builders verify the actual payload and platform signature before
+// upload. This portable gate checks the container type as well as its checksum;
+// it is deliberately not a replacement for native PKG/MSI validation.
+func verifyInstallerContainer(name string) error {
+	f, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	magic, minSize := []byte("xar!"), int64(28)
+	if strings.HasSuffix(name, ".msi") {
+		magic, minSize = []byte{0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1}, 512
+	}
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	header := make([]byte, len(magic))
+	if _, err := io.ReadFull(f, header); err != nil {
+		return fmt.Errorf("truncated installer: %w", err)
+	}
+	if info.Size() < minSize || !bytes.Equal(header, magic) {
+		return fmt.Errorf("invalid installer container")
+	}
+	return nil
+}
+
 func verifyChecksum(archivePath, checksumPath string) error {
 	checksumFile, err := os.Open(checksumPath)
 	if err != nil {
@@ -140,3 +178,62 @@ func verifyArchive(archivePath string, expected map[string]struct{}) error {
 	}
 	return nil
 }
+
+// ExtractBinaryArchive verifies the checksum and strict two-file archive
+// contract before writing signed payload bytes for a downstream installer job.
+// The destination must be new; no existing installation can be overwritten.
+func ExtractBinaryArchive(platform, archivePath, destination string) error {
+	expected := unixEntries
+	switch platform {
+	case "darwin":
+	case "windows":
+		expected = windowsEntries
+	default:
+		return fmt.Errorf("unsupported installer platform %q", platform)
+	}
+	if err := verifyChecksum(archivePath, archivePath+".sha256"); err != nil {
+		return err
+	}
+	if err := verifyArchive(archivePath, expected); err != nil {
+		return err
+	}
+	if err := os.Mkdir(destination, 0700); err != nil {
+		return err
+	}
+	file, err := os.Open(archivePath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	gz, err := gzip.NewReader(file)
+	if err != nil {
+		return err
+	}
+	defer gz.Close()
+	reader := tar.NewReader(gz)
+	for {
+		header, err := reader.Next()
+		if err == io.EOF {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		// Recheck names/types on the extraction pass as well.
+		if _, ok := expected[header.Name]; !ok || (header.Typeflag != tar.TypeReg && header.Typeflag != tar.TypeRegA) {
+			return fmt.Errorf("invalid payload entry %q", header.Name)
+		}
+		out, err := os.OpenFile(filepath.Join(destination, header.Name), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0755)
+		if err != nil {
+			return err
+		}
+		_, copyErr := io.Copy(out, reader)
+		closeErr := out.Close()
+		if copyErr != nil {
+			return copyErr
+		}
+		if closeErr != nil {
+			return closeErr
+		}
+	}
+}