Don't try to put symlinked files in archive.

utils/pub/command_lish.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library command_lish;
 
 import 'dart:io';
 import 'dart:json';
 import 'dart:uri';
 
@@ skipping 146 matching lines @@
         return Futures.wait(entries.map((entry) {
           return fileExists(entry).transform((isFile) {
             // Skip directories.
             if (!isFile) return null;
 
             // TODO(rnystrom): Making these relative will break archive
             // creation if the cwd is ever *not* the package root directory.
             // Should instead only make these relative right before generating
             // the tree display (which is what really needs them to be).
             // Make it relative to the package root.
-            return relativeTo(entry, rootDir);
+            entry = relativeTo(entry, rootDir);
+
+            // TODO(rnystrom): dir.list() will paths with resolved symlinks.

[Jennifer Messerly, 2012/12/12 23:49:25]

"will include paths" ?

[Siggi Cherem (dart-lang), 2012/12/12 23:53:56]

woah - I wrote something about this and when I hit save, John's comment showed
up. Magical :)

+            // In particular, we'll get paths to symlinked files from "packages"
+            // that reach outside of this package. Since the path has already
+            // been resolved, we don't even see "packages" in that path anymore.
+            // These should not be included in the archive. As a hack, ignore
+            // any file whose relative path is backing out of the root
+            // directory. Should do something cleaner.
+            if (entry.length > 1 && entry.startsWith('..')) return null;

[Jennifer Messerly, 2012/12/12 23:49:25]

entry.startsWith('..') implies entry.length > 1 right?

also might want to do "../"

+
+            return entry;
           });
         }));
       });
     }).transform((files) => files.filter((file) {
       if (file == null || _BLACKLISTED_FILES.contains(basename(file))) {
         return false;
       }
 
       return !splitPath(file).some(_BLACKLISTED_DIRECTORIES.contains);
     }));
@@ skipping 45 matching lines @@
         var s = warnings.length == 1 ? '' : 's';
         message = "Package has ${warnings.length} warning$s. Upload anyway";
       }
 
       return confirm(message).transform((confirmed) {
         if (!confirmed) throw "Package upload canceled.";
       });
     });
   }
 }