gleam-lang/gleam

Generated tarball contains malformed source code files

Open

#4697 opened on Jun 18, 2025

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Rust (21,417 stars) (960 forks)batch import
help wanted

Description

Gleam version: 1.11.1 OS: Arch Linux

When publishing a package, it appears to be possible for the files that end up in the tarball to be randomly messed up. After having no issues with publishing multiple iterations of a project of mine for a while, one version I published ended up having this issue, and it meant that when adding the package to any other projects, those projects would fail to build, even though there were no build issues when locally building the package that was published. For an example, see these two tarballs that were uploaded using gleam publish, both built from the exact same code (minus the version number bump in the gleam.toml): https://repo.hex.pm/tarballs/spacetraders_sdk-1.5.0.tar https://repo.hex.pm/tarballs/spacetraders_sdk-1.5.1.tar In the former there are multiple invalid source code files present, and in the latter (which had to be built on a separate machine to not generate an invalid tarball) there are no issues. I'm currently still unable to build a valid tarball with no messed up files on the original machine where the issue occurred. The machine that builds the invalid tarball is running Arch Linux and has tar version 1.35, while the machine that can build it successfully is running Debian and has tar version 1.34. So it's possibly a bug introduced in tar 1.35? I did find this bug report which is possibly related: https://savannah.gnu.org/bugs/?65210

Contributor guide

Tech stack
rust
Domain
releasebuild system
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Rust programmingtar commandGleam build systemLinux
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65
Research direction
Investigate the code responsible for generating the tarball during publishing (likely in the 'build' or 'publish' module of the Gleam compiler). Check the version of tar installed and consider using a workaround for tar 1.35, such as passing specific flags. Compare the valid and invalid tarballs to identify the malformed patterns. Review the linked bug report at https://savannah.gnu.org/bugs/?65210 for potential solutions.