fix: symlinks handling

analysis_options.yaml

@@ -22,7 +22,6 @@ linter:
     - missing_whitespace_between_adjacent_strings
     - no_adjacent_strings_in_list
     - no_runtimeType_toString
-    - package_api_docs
     - prefer_const_declarations
     - prefer_final_locals
     - require_trailing_commas

lib/src/package.dart

@@ -278,27 +278,57 @@ See $workspacesDocUrl for more information.
       return p.join(root, path);
     }
 
-    return Ignore.listFiles(
+    /// Throws if [path] is a link that cannot resolve.
+    ///
+    /// Circular links will fail to resolve at some depth defined by the os.
+    void verifyLink(String path) {
+      final link = Link(path);
+      if (link.existsSync()) {
+        try {
+          link.resolveSymbolicLinksSync();
+        } on FileSystemException catch (e) {
+          throw DataException(
+            'Could not resolve symbolic link $path. $e',
+          );
+        }
+      }
+    }
+
+    /// We check each directory that it doesn't symlink-resolve to the
+    /// symlink-resolution of any parent directory of itself. This avoids
+    /// cycles.
+    ///
+    /// Cache the symlink resolutions here.
+    final symlinkResolvedDirs = <String, String>{};
+
+    final result = Ignore.listFiles(
       beneath: beneath,
       listDir: (dir) {
-        var contents = Directory(resolve(dir)).listSync();
+        final resolvedDir = p.normalize(resolve(dir));
+        verifyLink(resolvedDir);
+
+        {
+          final canonicalized = p.canonicalize(resolvedDir);
+          final symlinkResolvedDir = symlinkResolvedDirs[canonicalized] ??=
+              Directory(canonicalized).resolveSymbolicLinksSync();
+          for (final parent in parentDirs(p.dirname(canonicalized))) {
+            final symlinkResolvedParent = symlinkResolvedDirs[parent] ??=
+                Directory(parent).resolveSymbolicLinksSync();
+            if (p.equals(symlinkResolvedDir, symlinkResolvedParent)) {
+              dataError('''
+Pub does not support symlink cycles.
+
+$symlinkResolvedDir => ${p.canonicalize(symlinkResolvedParent)}
+''');
+            }
+          }
+        }
+        var contents = Directory(resolvedDir).listSync(followLinks: false);
+
         if (!recursive) {
           contents = contents.where((entity) => entity is! Directory).toList();
         }
         return contents.map((entity) {
-          if (linkExists(entity.path)) {
-            final target = Link(entity.path).targetSync();
-            if (dirExists(entity.path)) {
-              throw DataException(
-                '''Pub does not support publishing packages with directory symlinks: `${entity.path}`.''',
-              );
-            }
-            if (!fileExists(entity.path)) {
-              throw DataException(
-                '''Pub does not support publishing packages with non-resolving symlink: `${entity.path}` => `$target`.''',
-              );
-            }
-          }
           final relative = p.relative(entity.path, from: root);
           if (Platform.isWindows) {
             return p.posix.joinAll(p.split(relative));
@@ -367,6 +397,10 @@ See $workspacesDocUrl for more information.
       isDir: (dir) => dirExists(resolve(dir)),
       includeDirs: includeDirs,
     ).map(resolve).toList();
+    for (final f in result) {
+      verifyLink(f);
+    }
+    return result;
   }
 
   /// Applies [transform] to each package in the workspace and returns a derived

lib/src/validator/gitignore.dart

@@ -71,13 +71,11 @@ class GitignoreValidator extends Validator {
       final unignoredByGitignore = Ignore.listFiles(
         beneath: beneath,
         listDir: (dir) {
-          final contents = Directory(resolve(dir)).listSync();
-          return contents
-              .where((e) => !(linkExists(e.path) && dirExists(e.path)))
-              .map(
-                (entity) => p.posix
-                    .joinAll(p.split(p.relative(entity.path, from: root))),
-              );
+          final contents = Directory(resolve(dir)).listSync(followLinks: false);
+          return contents.map(
+            (entity) =>
+                p.posix.joinAll(p.split(p.relative(entity.path, from: root))),
+          );
         },
         ignoreForDir: (dir) {
           final gitIgnore = resolve('$dir/.gitignore');
@@ -86,7 +84,10 @@ class GitignoreValidator extends Validator {
           ];
           return rules.isEmpty ? null : Ignore(rules);
         },
-        isDir: (dir) => dirExists(resolve(dir)),
+        isDir: (dir) {
+          final resolved = resolve(dir);
+          return dirExists(resolved) && !linkExists(resolved);
+        },
       ).map((file) {
         final relative = p.relative(resolve(file), from: package.dir);
         return Platform.isWindows

pubspec.lock

@@ -5,23 +5,23 @@ packages:
     dependency: transitive
     description:
       name: _fe_analyzer_shared
-      sha256: c57b02f47e021c9d7ced6d2e28824b315e0fd585578274bc4c2a5db0626f154a
+      sha256: "45cfa8471b89fb6643fe9bf51bd7931a76b8f5ec2d65de4fb176dba8d4f22c77"
       url: "https://pub.dev"
     source: hosted
-    version: "75.0.0"
+    version: "73.0.0"
   _macros:
     dependency: transitive
     description: dart
     source: sdk
-    version: "0.3.3"
+    version: "0.3.2"
   analyzer:
     dependency: "direct main"
     description:
       name: analyzer
-      sha256: ef226c581b7cd875f734125b1b9928df3db08cc85ff87ce7d9be89a677aaee23
+      sha256: "4959fec185fe70cce007c57e9ab6983101dbe593d2bf8bbfb4453aaec0cf470a"
       url: "https://pub.dev"
     source: hosted
-    version: "6.10.0"
+    version: "6.8.0"
   args:
     dependency: "direct main"
     description:
@@ -178,10 +178,10 @@ packages:
     dependency: transitive
     description:
       name: lints
-      sha256: "4a16b3f03741e1252fda5de3ce712666d010ba2122f8e912c94f9f7b90e1a4c3"
+      sha256: "3315600f3fb3b135be672bf4a178c55f274bebe368325ae18462c89ac1e3b413"
       url: "https://pub.dev"
     source: hosted
-    version: "5.1.0"
+    version: "5.0.0"
   logging:
     dependency: transitive
     description:
@@ -194,10 +194,10 @@ packages:
     dependency: transitive
     description:
       name: macros
-      sha256: "1d9e801cd66f7ea3663c45fc708450db1fa57f988142c64289142c9b7ee80656"
+      sha256: "0acaed5d6b7eab89f63350bccd82119e6c602df0f391260d0e32b5e23db79536"
       url: "https://pub.dev"
     source: hosted
-    version: "0.1.3-main.0"
+    version: "0.1.2-main.4"
   matcher:
     dependency: transitive
     description:
@@ -479,4 +479,4 @@ packages:
     source: hosted
     version: "2.2.1"
 sdks:
-  dart: ">=3.6.0-0 <4.0.0"
+  dart: ">=3.5.0 <4.0.0"

test/lish/symlinks_test.dart

@@ -0,0 +1,69 @@
+// Copyright (c) 2025, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+import 'dart:io';
+
+import 'package:path/path.dart' as p;
+import 'package:tar/tar.dart';
+import 'package:test/test.dart';
+
+import '../descriptor.dart';
+import '../test_pub.dart';
+
+Future<void> main() async {
+  test('symlink directories are replaced by their targets', () async {
+    await validPackage().create();
+    await dir('a', [file('aa', 'aaa')]).create();
+    await file('t', 'ttt').create();
+
+    await dir(appPath, [
+      dir('b', [file('bb', 'bbb')]),
+    ]).create();
+    Link(p.join(sandbox, appPath, 'symlink_to_dir_outside_package'))
+        .createSync(p.join(sandbox, 'a'));
+    Link(p.join(sandbox, appPath, 'symlink_to_dir_outside_package_relative'))
+        .createSync(p.join('..', 'a'));
+    Link(p.join(sandbox, appPath, 'symlink_to_dir_inside_package'))
+        .createSync(p.join(sandbox, appPath, 'b'));
+    Link(p.join(sandbox, appPath, 'symlink_to_dir_inside_package_relative'))
+        .createSync('b');
+    Link(p.join(sandbox, appPath, 'b', 'l')).createSync(p.join(sandbox, 't'));
+
+    await runPub(args: ['publish', '--to-archive=archive.tar.gz']);
+
+    final reader = TarReader(
+      File(p.join(sandbox, appPath, 'archive.tar.gz'))
+          .openRead()
+          .transform(GZipCodec().decoder),
+    );
+
+    while (await reader.moveNext()) {
+      final current = reader.current;
+      expect(current.type, isNot(TypeFlag.symlink));
+    }
+
+    await runPub(args: ['cache', 'preload', 'archive.tar.gz']);
+
+    await dir('test_pkg-1.0.0', [
+      ...validPackage().contents,
+      dir('symlink_to_dir_outside_package', [
+        file('aa', 'aaa'),
+      ]),
+      dir('symlink_to_dir_outside_package_relative', [
+        file('aa', 'aaa'),
+      ]),
+      dir('b', [file('bb', 'bbb')]),
+      dir('symlink_to_dir_inside_package', [
+        file('bb', 'bbb'),
+        file('l', 'ttt'),
+      ]),
+      dir('symlink_to_dir_inside_package_relative', [
+        file('bb', 'bbb'),
+        file('l', 'ttt'),
+      ]),
+    ]).validate(
+      p.join(sandbox, cachePath, 'hosted', 'pub.dev'),
+    );
+  });
+}