What causes "failed to walk extracted directory: %w" in anomalyco/sst?

Check permissions on the extracted directory and chmod readable/executable as needed (find extractedDir -type d -exec chmod u+rx {} +)

anomalyco/sst · error

failed to walk extracted directory: %w

Error message

failed to walk extracted directory: %w

What it means

flattenPackageToRoot walks the extracted directory with filepath.WalkDir to move package contents up one level (flattening versioned dirs like pkg-1.0.0/ into the package root). If the walk callback returns an error, it is wrapped as "failed to walk extracted directory". This indicates unreadable directories/files in the freshly extracted archive or a filesystem error during traversal.

Source

Thrown at pkg/runtime/python/build.go:524

		if err != nil {
			return err
		}

		// Skip directories
		if info.IsDir() {
			return nil
		}

		ext := filepath.Ext(path)
		if ext == ".py" || ext == ".pyi" || info.Name() == "py.typed" {
			pythonFiles = append(pythonFiles, path)
		}

		return nil
	})

	if err != nil {
		return fmt.Errorf("failed to walk extracted directory: %w", err)
	}

	// Create output directory
	if err := os.MkdirAll(outputDir, 0755); err != nil {
		return fmt.Errorf("failed to create output directory: %w", err)
	}

	for _, srcFile := range pythonFiles {
		relPath, _ := filepath.Rel(extractedDir, srcFile)
		destFile := filepath.Join(outputDir, relPath)

		if err := copyFile(srcFile, destFile); err != nil {
			return fmt.Errorf("failed to copy %s to %s: %w", srcFile, destFile, err)
		}
	}

	// Clean up the extracted directory
	os.RemoveAll(extractedDir)

View on GitHub (pinned to a0bd20f762)

Solutions

Check permissions on the extracted directory and chmod readable/executable as needed (find extractedDir -type d -exec chmod u+rx {} +)
Re-extract with modes normalized so restrictive tar modes don't propagate
Inspect for symlinks or odd entries with tar -tzvf and remove/repackage them if you own the archive
Verify disk health and free space
As a workaround, disable flattening by using a standard (non-flattened) package layout

Defensive patterns

Strategy: validation

Validate before calling

err := filepath.WalkDir(extractedDir, func(p string, d fs.DirEntry, err error) error {
    if err != nil {
        return err
    }
    info, err := d.Info()
    if err != nil {
        return err
    }
    if info.Mode()&0400 == 0 {
        return fmt.Errorf("unreadable entry: %s", p)
    }
    return nil
})
if err != nil {
    return fmt.Errorf("extracted dir not traversable: %w", err)
}

Try / catch

if err := processPackageArchive(...); err != nil {
    if strings.Contains(err.Error(), "failed to walk extracted directory") {
        // fix permissions on extractedDir and retry once
        exec.Command("chmod", "-R", "u+rX", extractedDir).Run()
        return retry()
    }
    return err
}

Prevention

Normalize file modes after extraction so restrictive tar modes don't block traversal
Run the build as the same user that owns the extracted files
Avoid archives containing symlinks outside the package root
Check disk health/space if walk errors persist

When it happens

Trigger: filepath.WalkDir fails because an extracted entry is unreadable (permissions from the tar preserved restrictive modes), a symlink points outside the archive, or an I/O error occurs while listing directories.

Common situations: Archives containing files with mode 000 or ownership of another user; macOS-style archives with resource-fork entries that break traversal; symlink-heavy packages; extraction to a failing/full disk.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/f73d2b08fd181ae8. Report an issue: GitHub.