From f7cac257ade5775c1dfc255f4fda2eacc296e9d0 Mon Sep 17 00:00:00 2001
From: Minh Vu <vuhoangminh97@gmail.com>
Date: Wed, 24 Jun 2026 00:36:01 +0200
Subject: [PATCH] Fix Windows GraalVM installation (#1687)

## What changed

This updates the GraalVM install task so Windows installs use ZIP extraction instead of the Unix tar path. Windows now publishes the extracted directory by moving it into place, while macOS and Linux keep the existing tar extraction and symlink-based install flow.

## Why

BuildInfo.GraalVm downloads .zip archives on Windows, but InstallGraalVm always ran tar --strip-components=1 -xzf and then tried to install by creating a symbolic link. That combination is fragile on Windows: the archive format does not match the extraction command, and symlink creation can require special privileges.
---
 build-logic/src/main/kotlin/InstallGraalVm.kt | 97 +++++++++++++++----
 1 file changed, 78 insertions(+), 19 deletions(-)

diff --git a/build-logic/src/main/kotlin/InstallGraalVm.kt b/build-logic/src/main/kotlin/InstallGraalVm.kt
index d7a9dbc63..5b5d69d03 100644
--- a/build-logic/src/main/kotlin/InstallGraalVm.kt
+++ b/build-logic/src/main/kotlin/InstallGraalVm.kt
@@ -13,10 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import java.nio.file.AtomicMoveNotSupportedException
 import java.nio.file.Files
+import java.nio.file.Path
 import java.nio.file.Paths
 import java.nio.file.StandardCopyOption
 import java.util.*
+import java.util.zip.ZipInputStream
 import javax.inject.Inject
 import kotlin.io.path.createDirectories
 import org.gradle.api.DefaultTask
@@ -41,19 +44,14 @@ constructor(
   @TaskAction
   @Suppress("unused")
   fun run() {
-    // minimize chance of corruption by extract-to-random-dir-and-flip-symlink
+    // minimize chance of corruption by extract-to-random-dir-and-publish
     val distroDir = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
     try {
       distroDir.createDirectories()
       println("Extracting ${graalVm.get().downloadFile} into $distroDir")
-      // faster and more reliable than Gradle's `copy { from tarTree() }`
-      execOperations.exec {
-        workingDir = distroDir.toFile()
-        executable = "tar"
-        args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
-      }
-
       val os = org.gradle.internal.os.OperatingSystem.current()
+      if (os.isWindows) extractZip(distroDir) else extractTarGz(distroDir)
+
       val distroBinDir =
         if (os.isMacOsX) distroDir.resolve("Contents/Home/bin") else distroDir.resolve("bin")
 
@@ -70,17 +68,7 @@ constructor(
         }
       }
 
-      println("Creating symlink ${graalVm.get().installDir} for $distroDir")
-      val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
-      Files.createSymbolicLink(tempLink, distroDir)
-      try {
-        Files.move(tempLink, graalVm.get().installDir.toPath(), StandardCopyOption.ATOMIC_MOVE)
-      } catch (e: Exception) {
-        try {
-          fileOperations.delete(tempLink.toFile())
-        } catch (ignored: Exception) {}
-        throw e
-      }
+      publishInstallDir(distroDir, os)
     } catch (e: Exception) {
       try {
         fileOperations.delete(distroDir)
@@ -88,4 +76,75 @@ constructor(
       throw e
     }
   }
+
+  private fun extractTarGz(distroDir: Path) {
+    // faster and more reliable than Gradle's `copy { from tarTree() }`
+    execOperations.exec {
+      workingDir = distroDir.toFile()
+      executable = "tar"
+      args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
+    }
+  }
+
+  private fun extractZip(distroDir: Path) {
+    val targetDir = distroDir.toAbsolutePath().normalize()
+    ZipInputStream(graalVm.get().downloadFile.inputStream().buffered()).use { zipInput ->
+      var entry = zipInput.nextEntry
+      while (entry != null) {
+        try {
+          val strippedPath = stripFirstPathComponent(entry.name)
+          if (strippedPath != null) {
+            val target = targetDir.resolve(strippedPath).normalize()
+            require(target.startsWith(targetDir)) {
+              "GraalVM archive entry escapes destination directory: ${entry.name}"
+            }
+            if (entry.isDirectory) {
+              target.createDirectories()
+            } else {
+              target.parent?.createDirectories()
+              Files.copy(zipInput, target)
+            }
+          }
+        } finally {
+          zipInput.closeEntry()
+        }
+        entry = zipInput.nextEntry
+      }
+    }
+  }
+
+  private fun stripFirstPathComponent(path: String): String? {
+    val normalizedPath = path.replace('\\', '/').trimStart('/')
+    val separatorIndex = normalizedPath.indexOf('/')
+    if (separatorIndex == -1) return null
+    return normalizedPath.substring(separatorIndex + 1).takeIf { it.isNotEmpty() }
+  }
+
+  private fun publishInstallDir(distroDir: Path, os: org.gradle.internal.os.OperatingSystem) {
+    if (os.isWindows) {
+      println("Installing ${graalVm.get().installDir} from $distroDir")
+      moveAtomicallyOrRegularly(distroDir, graalVm.get().installDir.toPath())
+      return
+    }
+
+    println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+    val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+    Files.createSymbolicLink(tempLink, distroDir)
+    try {
+      moveAtomicallyOrRegularly(tempLink, graalVm.get().installDir.toPath())
+    } catch (e: Exception) {
+      try {
+        fileOperations.delete(tempLink.toFile())
+      } catch (ignored: Exception) {}
+      throw e
+    }
+  }
+
+  private fun moveAtomicallyOrRegularly(source: Path, target: Path) {
+    try {
+      Files.move(source, target, StandardCopyOption.ATOMIC_MOVE)
+    } catch (e: AtomicMoveNotSupportedException) {
+      Files.move(source, target)
+    }
+  }
 }