# GNU tar Responsible Disclosure Package

## Tested versions

- GNU tar 1.35
- GNU tar upstream HEAD (tested 2026-07-03)
- Ubuntu package: tar 1.35+dfsg-4

## Included archive

artifacts/poc/graal-v6.tar

## Verify integrity

Run:

    cd artifacts/poc
    sha256sum -c SHA256SUMS

## Minimal reproduction

Create an empty working directory:

    mkdir restore
    cd restore

Extract the archive:

    tar --listed-incremental=/dev/null \
        -xvf ../artifacts/poc/graal-v6.tar

## Observed behaviour

- Extraction completes successfully.
- Exit status is 0.
- No stderr diagnostics are emitted.
- The delayed hardlink processing operates on a stale pathname after GNU.dumpdir directory renaming.

## Included evidence

artifacts/logs/

This package accompanies a responsible disclosure sent to the GNU tar maintainers.
