@caelo-cms/provisioning 0.10.53 → 0.10.57

package/src/state-store.ts

@@ -22,12 +22,24 @@
  */
 
 import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { hostname } from "node:os";
 import { join } from "node:path";
 import { assertNoCheckpointSecrets, assertNoSecrets } from "./checkpoint-secrets.js";
 import { type GcloudResult, gcloudEnv } from "./gcloud.js";
 import { OPS_INSTALL_PREFIX } from "./state-backend.js";
+import {
+  describeExecutionArgs,
+  type ExecutionLockHolder,
+  judgeHeldLock,
+  type LocalHost,
+  type LockHolder,
+  lockBody,
+  PROCESS_LEASE_MS,
+  parseExecutionState,
+  parseLockBody,
+  renewedLockBody,
+} from "./state-lock-lease.js";
 
 /** The two documents a store holds. */
 export type StateFile = "install.json" | "progress.json";
@@ -176,58 +188,324 @@ export function bucketStateLockUrl(bucket: string): string {
   return `gs://${bucket}/${OPS_INSTALL_PREFIX}/state.lock`;
 }
 
-/** Who holds a lock, for the refusal message. */
-function lockBody(purpose: string): string {
-  return JSON.stringify({
-    purpose,
-    host: hostname(),
-    pid: process.pid,
-    startedAt: new Date().toISOString(),
-  });
+/** gcloud's wording for a failed `--if-generation-match` precondition. */
+const PRECONDITION_FAILED = /PreconditionFailed|412|At least one of the pre-conditions/i;
+
+/** How a bucket lock is taken: who holds it, and the clock to judge leases by. */
+export interface BucketLockOptions {
+  /**
+   * The Cloud Run execution taking the lock (#815): the lock's lease is the
+   * execution's task timeout, and a later run may break it once Cloud Run
+   * says this execution has finished. Without it the holder is this
+   * process (a CLI run): the lock names host + pid, carries a lease of
+   * {@link PROCESS_LEASE_MS} and is renewed by a heartbeat until released.
+   */
+  readonly holder?: ExecutionLockHolder;
+  /** Told when a dead holder's lock was broken, with why. */
+  readonly onBreak?: (message: string) => void;
+  /**
+   * Told when the heartbeat found the lock no longer this run's (another
+   * run broke it after the lease ran out, e.g. while this machine slept).
+   */
+  readonly onLost?: (message: string) => void;
+  readonly now?: () => Date;
+  /** Starts the heartbeat; returns its stop. Defaults to an unref'd setInterval. */
+  readonly schedule?: (tick: () => void, everyMs: number) => () => void;
+  /** This host and its pid check (state-lock-lease.ts LocalHost); tests pass a fake. */
+  readonly here?: LocalHost;
 }
 
+const defaultSchedule = (tick: () => void, everyMs: number): (() => void) => {
+  const timer = setInterval(tick, everyMs);
+  // The heartbeat must never keep a finished CLI alive.
+  timer.unref?.();
+  return () => clearInterval(timer);
+};
+
 /**
  * The install's state lock in its ops bucket, created only if absent
  * (`--if-generation-match=0`). Held by every writer of a bucket-backed
- * install's state — an installer run's `pulumi up`, `state migrate` — so
- * none writes a backend another is switching away from. A lock left by a
- * crashed run is reported with the command to remove it, never broken
- * automatically.
+ * install's state — an installer run's `pulumi up`, `state migrate`, the
+ * CLI `upgrade`, the upgrader job — so none writes a backend another is
+ * switching away from.
  *
- * @returns the release function
+ * A lock that is held is judged (state-lock-lease.ts): one whose Cloud Run
+ * execution has finished, whose execution is gone after its lease, whose
+ * CLI process is gone on this host, or whose CLI lease ran out unrenewed,
+ * is broken with a generation-matched delete and taken once more. The
+ * generation is read BEFORE the body, so the delete can only remove the
+ * lock that was judged: if another run replaced it in between, the
+ * delete's precondition fails and nothing is removed. Two runs breaking the
+ * same dead lock cannot both win either — the slower one's create fails
+ * its own precondition and reports the lock as held.
+ *
+ * A CLI holder renews its lease every third of {@link PROCESS_LEASE_MS}
+ * with a generation-matched rewrite, so a run that is alive keeps its lock
+ * however long it takes, and a killed one loses it within one lease.
+ *
+ * @returns the release function; it stops the heartbeat and deletes only
+ *   this lock's generation
+ * @throws StateLockHeldError when another run holds the lock
+ * @throws Error when the lock or its holder cannot be read (no access)
  */
 export function acquireBucketStateLock(
   bucket: string,
   purpose: string,
   run: SyncGcloud = realSyncGcloud,
+  opts: BucketLockOptions = {},
 ): () => void {
   const url = bucketStateLockUrl(bucket);
-  const r = run(["storage", "cp", "-", url, "--if-generation-match=0"], lockBody(purpose));
-  if (!r.ok) {
-    if (/PreconditionFailed|412|At least one of the pre-conditions/i.test(r.stderr)) {
-      const held = run(["storage", "cat", url]);
+  const now = opts.now ?? (() => new Date());
+  const holder: LockHolder = opts.holder ?? { leaseMs: PROCESS_LEASE_MS };
+  const id = randomUUID();
+  const create = () =>
+    run(
+      ["storage", "cp", "-", url, "--if-generation-match=0"],
+      lockBody(purpose, now(), holder, id),
+    );
+  let r = create();
+  if (!r.ok && PRECONDITION_FAILED.test(r.stderr)) {
+    breakDeadLock(url, run, now(), opts.onBreak, opts.here);
+    r = create();
+    if (!r.ok && PRECONDITION_FAILED.test(r.stderr)) {
       throw new StateLockHeldError(
-        `Another run is changing this install's state (${held.ok ? held.stdout.trim() : url}). Re-run once it has finished; if none is running, remove the stale lock: gcloud storage rm ${url}`,
+        `Another run took this install's state lock at the same moment (${readLockText(url, run)}). Re-run once it has finished.`,
       );
     }
-    throw new Error(`Could not take the state lock ${url}: ${r.stderr.trim()}`);
   }
+  if (!r.ok) throw new Error(`Could not take the state lock ${url}: ${r.stderr.trim()}`);
+  const owned = ownedGeneration(url, run, id);
+  if (owned.kind !== "owned") {
+    // Ours, just created — but without its generation a delete could hit a
+    // successor's lock. Give it back only once a second look proves it is
+    // still ours at a known generation; otherwise its lease ends it.
+    const retry = ownedGeneration(url, run, id);
+    if (retry.kind === "owned") {
+      run(["storage", "rm", url, `--if-generation-match=${retry.generation}`]);
+    }
+    throw new Error(
+      `Could not read the generation of the state lock ${url} this run just took (${owned.why}). ${
+        retry.kind === "owned"
+          ? "It was given back."
+          : "It was left in place and expires with its lease; re-run after that."
+      }`,
+    );
+  }
+  let generation = owned.generation;
+  let lost: string | null = null;
+  const stopHeartbeat =
+    "execution" in holder
+      ? () => {}
+      : (opts.schedule ?? defaultSchedule)(
+          () => {
+            if (lost !== null) return;
+            const renewed = renewLock(url, run, id, generation, now(), holder.leaseMs);
+            if (renewed.kind === "owned") {
+              generation = renewed.generation;
+              return;
+            }
+            if (renewed.kind === "lost") {
+              lost = renewed.why;
+              opts.onLost?.(
+                `This run no longer holds the install's state lock (${renewed.why}). Stop it and re-run once the other run has finished.`,
+              );
+            }
+            // "error": a transient failure; the next beat tries again within the lease.
+          },
+          Math.floor(holder.leaseMs / 3),
+        );
   return () => {
-    const rm = run(["storage", "rm", url]);
-    if (!rm.ok) throw new Error(`Could not release ${url}; remove it: gcloud storage rm ${url}`);
+    stopHeartbeat();
+    const rm = run(["storage", "rm", url, `--if-generation-match=${generation}`]);
+    if (rm.ok) return;
+    if (PRECONDITION_FAILED.test(rm.stderr) || NOT_FOUND.test(rm.stderr)) {
+      throw new Error(
+        `The state lock ${url} was no longer this run's when it finished (another run broke it); it was left alone.`,
+      );
+    }
+    throw new Error(`Could not release ${url}; remove it: gcloud storage rm ${url}`);
   };
 }
 
+type Ownership =
+  | { readonly kind: "owned"; readonly generation: string }
+  | { readonly kind: "lost"; readonly why: string }
+  | { readonly kind: "error"; readonly why: string };
+
+/**
+ * The lock's generation, provided the lock is still the one with `id`. The
+ * generation is read before the body: if another run replaced the lock in
+ * between, the body names its id and this returns "lost" — never a
+ * generation that is not ours.
+ */
+function ownedGeneration(url: string, run: SyncGcloud, id: string): Ownership {
+  const g = lockGeneration(url, run);
+  if (g.kind === "absent") return { kind: "lost", why: "the lock is gone" };
+  if (g.kind === "error") return { kind: "error", why: g.error };
+  const body = run(["storage", "cat", url]);
+  if (!body.ok) {
+    return NOT_FOUND.test(body.stderr)
+      ? { kind: "lost", why: "the lock is gone" }
+      : { kind: "error", why: body.stderr.trim() || `gcloud exited ${body.exitCode}` };
+  }
+  const parsed = parseLockBody(body.stdout);
+  if (parsed?.id !== id) {
+    return { kind: "lost", why: `another run holds it now (${body.stdout.trim().slice(0, 200)})` };
+  }
+  return { kind: "owned", generation: g.generation };
+}
+
+/**
+ * One heartbeat: rewrite the lock with a later lease, only if it is still
+ * at `generation` (ours), and return its new generation.
+ */
+function renewLock(
+  url: string,
+  run: SyncGcloud,
+  id: string,
+  generation: string,
+  now: Date,
+  leaseMs: number,
+): Ownership {
+  const current = run(["storage", "cat", url]);
+  if (!current.ok) {
+    return NOT_FOUND.test(current.stderr)
+      ? { kind: "lost", why: "the lock is gone" }
+      : { kind: "error", why: current.stderr.trim() };
+  }
+  const body = parseLockBody(current.stdout);
+  if (body?.id !== id) {
+    return {
+      kind: "lost",
+      why: `another run holds it now (${current.stdout.trim().slice(0, 200)})`,
+    };
+  }
+  const w = run(
+    ["storage", "cp", "-", url, `--if-generation-match=${generation}`],
+    renewedLockBody(body, now, leaseMs),
+  );
+  if (!w.ok) {
+    return PRECONDITION_FAILED.test(w.stderr)
+      ? { kind: "lost", why: "another run replaced it" }
+      : { kind: "error", why: w.stderr.trim() };
+  }
+  return ownedGeneration(url, run, id);
+}
+
+type LockGeneration =
+  | { readonly kind: "found"; readonly generation: string }
+  | { readonly kind: "absent" }
+  | { readonly kind: "error"; readonly error: string };
+
+/** The lock object's current generation. */
+function lockGeneration(url: string, run: SyncGcloud): LockGeneration {
+  const d = run(["storage", "objects", "describe", url, "--format=json"]);
+  if (!d.ok) {
+    return NOT_FOUND.test(d.stderr)
+      ? { kind: "absent" }
+      : { kind: "error", error: d.stderr.trim() || `gcloud exited ${d.exitCode}` };
+  }
+  try {
+    // `gcloud storage objects describe` prints the generation as a string
+    // (`generation: '1706304784726341'`, cloud.google.com/storage/docs/
+    // viewing-editing-metadata); a JSON number would lose digits past 2^53,
+    // so only a string of digits is a generation the delete may match.
+    const g = (JSON.parse(d.stdout) as { generation?: unknown }).generation;
+    if (typeof g === "string" && /^[1-9][0-9]*$/.test(g)) {
+      return { kind: "found", generation: g };
+    }
+  } catch {
+    // Reported below with the same message as a missing field.
+  }
+  return { kind: "error", error: "gcloud described the lock without a generation" };
+}
+
+function readLockText(url: string, run: SyncGcloud): string {
+  const held = run(["storage", "cat", url]);
+  return held.ok ? held.stdout.trim() : url;
+}
+
+/**
+ * Judge the held lock at `url` and break it when its holder is dead.
+ * Returns normally when the lock was broken or vanished meanwhile, so the
+ * caller creates it once more; throws when it is live or cannot be judged.
+ */
+function breakDeadLock(
+  url: string,
+  run: SyncGcloud,
+  now: Date,
+  onBreak: ((message: string) => void) | undefined,
+  here: LocalHost | undefined,
+): void {
+  const found = lockGeneration(url, run);
+  if (found.kind === "absent") return;
+  if (found.kind === "error") {
+    throw new Error(`Could not read the state lock ${url} another run holds: ${found.error}`);
+  }
+  const held = run(["storage", "cat", url]);
+  if (!held.ok) {
+    if (NOT_FOUND.test(held.stderr)) return;
+    throw new Error(`Could not read the state lock ${url}: ${held.stderr.trim()}`);
+  }
+  const verdict = judgeHeldLock(
+    held.stdout,
+    (ref) => parseExecutionState(run(describeExecutionArgs(ref))),
+    now,
+    here,
+  );
+  if (verdict.kind === "unknown") {
+    // Not contention: retrying will not help, and guessing "dead" could let
+    // two runs write the same state.
+    throw new Error(`The state lock ${url} is held and ${verdict.why}`);
+  }
+  if (verdict.kind === "held") {
+    throw new StateLockHeldError(
+      verdict.manualRemoval
+        ? `Another run is changing this install's state (${verdict.why}). Re-run once it has finished; if none is running, remove the stale lock: gcloud storage rm ${url}`
+        : `Another run is changing this install's state: ${verdict.why}. Re-run once it has finished.`,
+    );
+  }
+  const rm = run(["storage", "rm", url, `--if-generation-match=${found.generation}`]);
+  if (!rm.ok && !NOT_FOUND.test(rm.stderr)) {
+    if (PRECONDITION_FAILED.test(rm.stderr)) {
+      throw new StateLockHeldError(
+        `Another run took this install's state lock while this one removed a stale one (${readLockText(url, run)}). Re-run once it has finished.`,
+      );
+    }
+    throw new Error(`Could not remove the stale state lock ${url}: ${rm.stderr.trim()}`);
+  }
+  onBreak?.(`Removed a stale state lock: ${verdict.why}.`);
+}
+
 /**
  * The same lock for an install whose state is on this machine:
- * `~/.caelo-<id>/state.lock`, created exclusively.
+ * `~/.caelo-<id>/state.lock`, created exclusively. A lock left by a
+ * process that is gone on this machine is taken over (#815).
  *
+ * @param here this host and its pid check; tests pass a fake
  * @returns the release function
  */
-export function acquireLocalStateLock(root: string, purpose: string): () => void {
+export function acquireLocalStateLock(root: string, purpose: string, here?: LocalHost): () => void {
   const path = join(root, "state.lock");
+  const take = () =>
+    writeFileSync(path, lockBody(purpose, new Date()), { flag: "wx", mode: 0o600 });
   try {
-    writeFileSync(path, lockBody(purpose), { flag: "wx", mode: 0o600 });
+    try {
+      take();
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code !== "EEXIST") throw e;
+      // #815 — the file is on this machine, so a holder whose process has
+      // ended is known dead: take its lock over instead of asking for `rm`.
+      const verdict = judgeHeldLock(
+        readFileSync(path, "utf8"),
+        () => ({ kind: "unknown", error: "a machine-local lock names no Cloud Run execution" }),
+        new Date(),
+        here,
+      );
+      if (verdict.kind !== "break") throw e;
+      rmSync(path, { force: true });
+      take();
+    }
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code === "EEXIST") {
       throw new StateLockHeldError(
@@ -245,8 +523,50 @@ export function acquireStateLock(
   root: string,
   purpose: string,
   run: SyncGcloud = realSyncGcloud,
+  opts: BucketLockOptions = {},
 ): () => void {
   return backend.kind === "gcs"
-    ? acquireBucketStateLock(backend.bucket, purpose, run)
-    : acquireLocalStateLock(root, purpose);
+    ? acquireBucketStateLock(backend.bucket, purpose, run, opts)
+    : acquireLocalStateLock(root, purpose, opts.here);
+}
+
+/** The part of `process` {@link releaseOnSignal} needs; tests pass a fake. */
+export interface SignalTarget {
+  once(signal: "SIGINT" | "SIGTERM", listener: () => void): unknown;
+  removeListener(signal: "SIGINT" | "SIGTERM", listener: () => void): unknown;
+  exit(code: number): never;
+}
+
+/**
+ * Give the state lock back when the CLI is stopped (Ctrl-C, a closed Cloud
+ * Shell tab's SIGTERM), then exit with the signal's conventional code
+ * (#815). Without this a stopped run leaves its lock until its lease ends.
+ *
+ * @param report told what happened to the lock
+ * @returns removes the handlers; call it once the run released the lock itself
+ */
+export function releaseOnSignal(
+  release: () => void,
+  report: (message: string) => void,
+  proc: SignalTarget = process,
+): () => void {
+  const dispose = () => {
+    proc.removeListener("SIGINT", onInt);
+    proc.removeListener("SIGTERM", onTerm);
+  };
+  const stop = (signal: "SIGINT" | "SIGTERM", code: number): never => {
+    dispose();
+    try {
+      release();
+      report(`Stopped (${signal}); the install's state lock was released.`);
+    } catch (e) {
+      report(`Stopped (${signal}); ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return proc.exit(code);
+  };
+  const onInt = () => stop("SIGINT", 130);
+  const onTerm = () => stop("SIGTERM", 143);
+  proc.once("SIGINT", onInt);
+  proc.once("SIGTERM", onTerm);
+  return dispose;
 }

package/src/tar-entries.test.ts

@@ -35,18 +35,160 @@ describe("listTarEntries", () => {
   });
 
   it("refuses a truncated archive instead of skipping members", () => {
-    const header = new Uint8Array(512);
-    header.set(new TextEncoder().encode("a.txt"), 0);
-    header.set(new TextEncoder().encode("00000001000\0"), 124); // 512 bytes of data, none present
-    header[156] = "0".charCodeAt(0);
-    expect(() => listTarEntries(header)).toThrow(/truncated/);
+    expect(() => listTarEntries(header("a.txt", "0", { sizeField: 512 }))).toThrow(/truncated/);
+  });
+
+  it("rejects PAX global extended headers ('g')", () => {
+    const g = member("PaxHeader", "g", paxLine("path=/etc/passwd"));
+    expect(() => listTarEntries(concat(g, member("safe.txt", "0"), END))).toThrow(
+      /pax global extended header/,
+    );
+  });
+
+  it("refuses a member named by two pax headers — GNU tar keeps the last, bsdtar drops the second", () => {
+    // Both tars extract `../../evil` here (the second header carries no
+    // path); reading the first header's path would have checked `safe.txt`.
+    const archive = concat(
+      member("PaxHeader", "x", paxLine("path=srv/caelo/safe.txt")),
+      member("PaxHeader", "x", paxLine("mtime=1")),
+      member("../../evil", "0"),
+      END,
+    );
+    expect(() => listTarEntries(archive)).toThrow(/several extension headers \(xx\)/);
+  });
+
+  it("refuses a GNU long name next to a pax path, and two long names", () => {
+    // bsdtar extracts the `L` name (`../../evil`), GNU tar the pax path.
+    const mixed = concat(
+      member("././@LongLink", "L", "../../evil\0"),
+      member("PaxHeader", "x", paxLine("path=srv/caelo/safe.txt")),
+      member("x", "0"),
+      END,
+    );
+    expect(() => listTarEntries(mixed)).toThrow(/several extension headers \(Lx\)/);
+    const twice = concat(
+      member("././@LongLink", "L", "../../evil\0"),
+      member("././@LongLink", "L", "safe.txt\0"),
+      member("x", "0"),
+      END,
+    );
+    expect(() => listTarEntries(twice)).toThrow(/several extension headers \(LL\)/);
+  });
+
+  it("still reads a GNU long name together with a long link", () => {
+    const archive = concat(
+      member("././@LongLink", "K", "target\0"),
+      member("././@LongLink", "L", `${"a".repeat(120)}\0`),
+      member("short", "2", "", { link: "ignored" }),
+      END,
+    );
+    expect(listTarEntries(archive)).toEqual([
+      { name: "a".repeat(120), type: "symlink", linkTarget: "target" },
+    ]);
+  });
+
+  it("refuses a header whose checksum does not match — GNU tar would skip it and read its body as headers", () => {
+    const archive = concat(
+      header("srv/caelo/safe.txt", "0", { sizeField: 512, badChecksum: true }),
+      header("../../evil", "0"),
+      END,
+    );
+    expect(() => listTarEntries(archive)).toThrow(/checksum mismatch/);
+  });
+
+  it("refuses a directory or symlink with a body — bsdtar reads the next block as a header", () => {
+    for (const [name, type] of [
+      ["srv/caelo/link", "2"],
+      ["srv/caelo/dir/", "5"],
+    ] as const) {
+      const archive = concat(
+        header(name, type, { sizeField: 512, link: "a" }),
+        header("../../evil", "0"),
+        END,
+      );
+      expect(() => listTarEntries(archive)).toThrow(/with a body/);
+    }
+  });
+
+  it("walks a member's body by its pax size, so a member hidden behind the header size is seen", () => {
+    // tar -x reads `safe.txt` as empty (pax size=0) and then extracts the
+    // `../../evil` header that the ustar size field claims is file data.
+    const archive = concat(
+      member("PaxHeader", "x", paxLine("size=0")),
+      header("safe.txt", "0", { sizeField: 512 }),
+      member("../../evil", "0"),
+      END,
+    );
+    expect(listTarEntries(archive).map((e) => e.name)).toEqual(["safe.txt", "../../evil"]);
+  });
+
+  it("rejects GNU sparse pax records and an unreadable pax size", () => {
+    const sparse = member("PaxHeader", "x", paxLine("GNU.sparse.name=../../evil"));
+    expect(() => listTarEntries(concat(sparse, member("safe.txt", "0")))).toThrow(/GNU sparse/);
+    const badSize = member("PaxHeader", "x", paxLine("size=-1"));
+    expect(() => listTarEntries(concat(badSize, member("safe.txt", "0")))).toThrow(
+      /unreadable pax size/,
+    );
   });
 });
 
-describe("escapesRoot", () => {
-  it("flags absolute and parent-relative member names", () => {
+const END = new Uint8Array(1024);
+
+/**
+ * One ustar header block with a valid checksum (unless `badChecksum`).
+ * `sizeField` is what the header claims, independent of any body after it.
+ */
+function header(
+  name: string,
+  typeflag: string,
+  opts: { sizeField?: number; link?: string; badChecksum?: boolean } = {},
+): Uint8Array {
+  const enc = new TextEncoder();
+  const h = new Uint8Array(512);
+  h.set(enc.encode(name), 0);
+  h.set(enc.encode(`${(opts.sizeField ?? 0).toString(8).padStart(11, "0")}\0`), 124);
+  h[156] = typeflag.charCodeAt(0);
+  if (opts.link) h.set(enc.encode(opts.link), 157);
+  h.set(enc.encode("ustar\0"), 257);
+  h.fill(0x20, 148, 156);
+  const sum = h.reduce((n, b) => n + b, 0) + (opts.badChecksum ? 1 : 0);
+  h.set(enc.encode(`${sum.toString(8).padStart(6, "0")}\0 `), 148);
+  return h;
+}
+
+/** A header plus its padded body. */
+function member(name: string, typeflag: string, bodyText = "", opts: { link?: string } = {}) {
+  const body = new TextEncoder().encode(bodyText);
+  const out = new Uint8Array(512 + Math.ceil(body.length / 512) * 512);
+  out.set(header(name, typeflag, { sizeField: body.length, link: opts.link }), 0);
+  out.set(body, 512);
+  return out;
+}
+
+/** One pax record; its leading length counts its own digits. */
+function paxLine(kv: string): string {
+  const base = ` ${kv}\n`;
+  const len = String(base.length + 2).length + base.length;
+  return `${len}${base}`;
+}
+
+function concat(...parts: Uint8Array[]): Uint8Array {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+
+describe("escapesRoot & normalizeMemberName", () => {
+  it("flags absolute, parent-relative, and dot-segment member names", () => {
     expect(escapesRoot("/etc/passwd")).toBe(true);
     expect(escapesRoot("srv/caelo/../../app")).toBe(true);
+    expect(escapesRoot(".//../etc/passwd")).toBe(true);
+    expect(escapesRoot("a/./b")).toBe(true);
     expect(escapesRoot("./srv/caelo/a..b")).toBe(false);
+    expect(normalizeMemberName(".//srv//caelo/")).toBe("srv/caelo");
   });
 });