#!/usr/bin/env python3
"""Fail closed on unsafe tar entries."""

import argparse
import tarfile
from pathlib import Path, PurePosixPath


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("archive", type=Path)
    args = parser.parse_args()
    with tarfile.open(args.archive, "r:*") as archive:
        members = archive.getmembers()
        if not members:
            raise ValueError("archive is empty")
        for member in members:
            path = PurePosixPath(member.name)
            if path.is_absolute() or ".." in path.parts:
                raise ValueError(f"unsafe archive path: {member.name}")
            if member.isdev():
                raise ValueError(f"device entry forbidden: {member.name}")
            if member.issym() or member.islnk():
                link = PurePosixPath(member.linkname)
                if link.is_absolute() or ".." in link.parts:
                    raise ValueError(
                        f"unsafe archive link: {member.name} -> {member.linkname}"
                    )
    print(f"SAFE_TAR entries={len(members)}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())