Thanks, using (method url-fetch/tarbomb) fixed my issue, later I need to fix package definition to prevent occurrence of tarbomb.
-- Reza On Mon, Jan 7, 2019, at 11:08 PM, Ricardo Wurmus wrote: > > Hi Reza, > > please always send replies to all recipents, including the list. > > > (source (origin > > (method url-fetch) > > (uri (string-append > > > > "https://s3.eu-central-1.amazonaws.com/source-git-pantherx-org/guix-tools_"; > > version ".tgz")) > > (sha256 > > (base32 "125h6h1b2i2q9vwlsi1y1yzqcn27vziqmg0w0cyaigkj9q0mc09q")))) > > This is a tarbomb. Its contents are directly unpacked to the current > directory. A well-behaved tarball should unpack into a directory. > > You can use (method url-fetch/tarbomb) in this case. > > -- > Ricardo >
