Merge commit from fork

* Use `tar_xf()` everywhere

* add news

Author: jaimergp

conda_build/convert.py

@@ -18,7 +18,7 @@
 from typing import TYPE_CHECKING
 
 from .exceptions import CondaBuildUserError
-from .utils import ensure_list, filter_info_files, walk
+from .utils import ensure_list, filter_info_files, tar_xf, walk
 
 if TYPE_CHECKING:
     from collections.abc import Iterable
@@ -131,9 +131,7 @@ def extract_temporary_directory(file_path):
     """
     temporary_directory = tempfile.mkdtemp()
 
-    source = tarfile.open(file_path)
-    source.extractall(temporary_directory)
-    source.close()
+    tar_xf(file_path, temporary_directory)
 
     return temporary_directory
 

conda_build/render.py

@@ -40,6 +40,7 @@
 from .utils import (
     CONDA_PACKAGE_EXTENSION_V1,
     package_record_to_requirement,
+    tar_xf,
 )
 from .variants import (
     filter_by_key_value,
@@ -947,8 +948,8 @@ def open_recipe(recipe: str | os.PathLike | Path) -> Iterator[Path]:
         yield recipe
     elif recipe.suffixes in [[".tar"], [".tar", ".gz"], [".tgz"], [".tar", ".bz2"]]:
         # extract the recipe to a temporary directory
-        with TemporaryDirectory() as tmp, tarfile.open(recipe, "r:*") as tar:
-            tar.extractall(path=tmp)
+        with TemporaryDirectory() as tmp:
+            tar_xf(recipe, tmp)
             yield Path(tmp)
     elif recipe.suffix == ".yaml":
         # read the recipe from the parent directory

news/tarextractall

@@ -0,0 +1,19 @@
+### Enhancements
+
+* <news item>
+
+### Bug fixes
+
+* Use `conda_build.utils.tar_xf` everywhere to avoid blind usage of `tar.extractall` in `conda render` and `conda convert`.
+
+### Deprecations
+
+* <news item>
+
+### Docs
+
+* <news item>
+
+### Other
+
+* <news item>