archive: fix creation time updates on Windows

[thaJeztah]

• follow-up to archive: harden tar extraction against path traversal #45

archive: add Windows creation time test

Add a regression test verifying that updating file timestamps also
updates the file creation time on Windows.

The current implementation preserves this behavior, which is relied on
by archive extraction and should remain unchanged during future
refactoring.

Commit df55fdf replaced the use of
our local chtimes implementation for os.Chtimes, which may be less
advanced and not set the creation time.

archive: fix creation time updates on Windows

Restore updating the creation time when applying timestamps on
Windows. The previous refactoring to os.Root.Chtimes() only updated
the access and modification times, causing a regression.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 84.61538% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.52%. Comparing base (216738e) to head (aa1541a).
⚠️ Report is 55 commits behind head on main.

Files with missing lines	Patch %	Lines
time_windows.go	91.30%	2 Missing and 2 partials ⚠️
archive.go	0.00%	0 Missing and 3 partials ⚠️
diff.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #79      +/-   ##
==========================================
- Coverage   65.81%   64.52%   -1.30%     
==========================================
  Files          42       44       +2     
  Lines        2039     2258     +219     
==========================================
+ Hits         1342     1457     +115     
- Misses        519      597      +78     
- Partials      178      204      +26     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[thaJeztah]

Failing with os.Root.Chtimes;

=== RUN   TestChtimesSetsCreationTime
    archive_windows_test.go:96: assertion failed: 2026-07-27 17:36:59.9053237 +0000 UTC (got time.Time) != 2001-02-03 04:05:06 +0000 UTC (want time.Time)
--- FAIL: TestChtimesSetsCreationTime (0.00s)

[thaJeztah]

This was more convoluted than I hoped; the TL;DR;

• os.Root.Chtimes does NOT set creation time.
• Our old code did, but did not have the protection from os.Root (first called os.Chmod)
• neither os.Root, nor golang.org/x/sys/windows have a windows.OpenAt (or similar) utility
• Golang stdlib itself DOES, but they MADE IT INTERNAL! 😠 https://github.com/golang/go/blob/go1.26.0/src/internal/syscall/windows/at_windows.go#L28-L41

const (
	O_NOFOLLOW_ANY = 0x200000000 // disallow symlinks anywhere in the path
	O_WRITE_ATTRS  = 0x800000000 // FILE_WRITE_ATTRIBUTES, used by Chmod
)

func Openat(dirfd syscall.Handle, name string, flag uint64, perm uint32) (_ syscall.Handle, e1 error) {
	if len(name) == 0 {
		return syscall.InvalidHandle, syscall.ERROR_FILE_NOT_FOUND
	}

	var access, options uint32
	// Map Win32 file flags to NT create options.
	fileFlags := uint32(flag) & FileFlagsMask
	if fileFlags&^ValidFileFlagsMask != 0 {

[thaJeztah]

Golang stdlib itself DOES, but they MADE IT INTERNAL! 😠

https://github.com/golang/go/blob/go1.26.0/src/internal/syscall/windows/at_windows.go#L28-L41

• This PR forks their internal package, so that we can use windows.Openat archive: rewrite chtimesAt using windows.Openat #88

[Copilot]

Pull request overview

This PR fixes a Windows regression where applying timestamps during archive extraction stopped updating file creation time after refactoring to os.Root-relative operations. It reintroduces creation-time updates on Windows and adds a Windows-only regression test to prevent future regressions.

Changes:

• Restore Windows creation-time updates by opening files relative to an os.Root parent handle and calling windows.SetFileTime for creation/access/modify.
• Switch internal timestamp setting to use a chtimes(root, name, atime, mtime) helper consistently (instead of calling root.Chtimes directly in a few places).
• Add a Windows regression test asserting that chtimes updates creation time.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
time_windows.go	Reintroduces Windows creation-time updates using a root-relative open + SetFileTime.
time_nonwindows.go	Updates chtimes to be os.Root-relative and reorders timeToTimespec helper.
archive.go	Routes timestamp application through chtimes(...) to preserve Windows semantics.
diff.go	Uses chtimes(...) for post-extraction directory timestamp normalization.
changes_test.go	Refactors test helpers to open an os.Root and use root-relative chtimes.
archive_windows_test.go	Adds regression coverage for Windows creation-time behavior.

Comments suppressed due to low confidence (2)

changes_test.go:320

• More path.Join usages in mutateSampleDir build filesystem paths with forward slashes. Switch these to filepath.Join for correct OS-specific separators.

	err = os.RemoveAll(path.Join(rootPath, "file5"))
	assert.NilError(t, err)
	err = os.MkdirAll(path.Join(rootPath, "file5"), 0o666)
	assert.NilError(t, err)

	// Create new file
	err = os.WriteFile(path.Join(rootPath, "filenew"), []byte("filenew\n"), 0o777)
	assert.NilError(t, err)

	// Create new dir
	err = os.MkdirAll(path.Join(rootPath, "dirnew"), 0o766)
	assert.NilError(t, err)

changes_test.go:337

• path.Join is also used for symlink and file paths later in mutateSampleDir; this can produce invalid Windows paths. Use filepath.Join consistently.

	err = os.Symlink("targetnew", path.Join(rootPath, "symlinknew"))
	assert.NilError(t, err)

	// Change a symlink
	err = os.RemoveAll(path.Join(rootPath, "symlink2"))
	assert.NilError(t, err)

	err = os.Symlink("target2change", path.Join(rootPath, "symlink2"))
	assert.NilError(t, err)

	// Replace dir with file
	err = os.RemoveAll(path.Join(rootPath, "dir2"))
	assert.NilError(t, err)
	err = os.WriteFile(path.Join(rootPath, "dir2"), []byte("dir2\n"), 0o777)
	assert.NilError(t, err)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

time_windows.go:13

• The doc comment for openForWriteAttributesAt is incomplete ("with permission to"), which makes the exported behavior unclear when reading the file.

// openForWriteAttributesAt opens name relative to parent with permission to
// If noFollow is true, it does not follow reparse points.

[vvoland]

This reintroduces the TOCTOU though? Except this time we can only modify the timestamp.. which probably isn't too bad.

[thaJeztah]

Good call; we need to look at some of the logic (and perhaps there's more to define w.r.t. "correct handling"), basically, in createTarFile;

1. createTarFile creates the file and writes its contents (if the tar header described a non-symlink.
2. chtimes re-opens the path and applies timestamps.

We (currently) drop the file handle between 1 and 2, but perform chtimes following symlinks (also for the last component). I think that's incorrect

NOTE: 👉 We do NOT currently call createTarFile concurrently; we always process the Tar sequentially, so we do not expect TOCTOU cases in our own code.

• The TOCTOU is between (1) and (2)
• We created a non-symlink (1), so (2) should expect it to still be the same type
• If the final component is now a symlink, that's unexpected, and we should rejected it regardless if the symlink is within root or outside of root

So; chtimes should;

• Open the parent path with os.Root (following symlinks, but within root - this can be improved if we preserve the parent file-handle); os.Root makes sure it's within root.
• Open the file handle itself (WITHOUT following symlinks)
• Error out if last component is a symlink/reparse point, because we didn't expect it to be.

I created a follow-up (but we can include in this PR if we think that makes sense);

• archive: do not follow reparse points in chtimes #90

[ctalledo]

Nice catch on the creation-time regression from the os.Root migration in #45. The fix looks correct and well-scoped, the root-relative NtCreateFile + SetFileTime helper is clearly documented with upstream references, and CI is green across the full matrix. LGTM. One optional test-strengthening suggestion inline.